PT-2007-6712 · Oneorzero · Oneorzero Helpdesk

Joseph · Published 2007-10-30 · Updated 2018-10-15 · CVE-2007-5727

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OneOrZero Helpdesk versions 1.6.4.2 through 1.6.5.4

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) "tcreate.php" or (2) "tupdate.php". This can be achieved using events such as onmouseover in a b tag.

Recommendations For OneOrZero Helpdesk versions 1.6.4.2 through 1.6.5.4, consider disabling the stripScripts function in common.php until a patch is available, and restrict access to the "tcreate.php" and "tupdate.php" endpoints to minimize the risk of exploitation. Avoid using the description parameter in these endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5727

Affected Products

Oneorzero Helpdesk

References · 8

• http://secunia.com/advisories/27415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5727 · Security Note
• http://securityreason.com/securityalert/3320 · Note
• http://osvdb.org/38836 · Note
• http://securityfocus.com/bid/26208 · Note
• http://securityfocus.com/archive/1/482790/100/0/threaded · Note
• http://osvdb.org/38215 · Note
• http://securityfocus.com/bid/26217 · Note