PT-2007-3355 · Deskpro · Deskpro

John Martinelli · Published 2007-04-12 · Updated 2018-10-16 · CVE-2007-2011

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DeskPro version 2.0.1

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the username parameter in the "login.php" file.

Recommendations For DeskPro version 2.0.1, update the login.php file to properly sanitize the username parameter to prevent XSS attacks.

Exploit

Fix

Related Identifiers

CVE-2007-2011

Affected Products

Deskpro

References · 10

• 🔥 http://securityfocus.com/bid/23381 · Exploit
• 🔥 https://exploit-db.com/exploits/29828 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2011 · Security Note
• http://secunia.com/advisories/24844 · Vendor Advisory
• http://john-martinelli.com/work/deskpro.txt · Note
• http://securityreason.com/securityalert/2556 · Note
• http://vupen.com/english/advisories/2007/1320 · Note
• http://osvdb.org/34721 · Note
• http://securityfocus.com/archive/1/465089/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2011 · Note