PT-2008-2230 · Astrosoft · Astrosoft Helpdesk

Alexandr Polyakov + 1 · Published 2008-02-06 · Updated 2018-10-15 · CVE-2008-0605

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AstroSoft HelpDesk versions prior to 1.95.228

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the txtSearch parameter to the "operator/article/article search results.asp" endpoint and the Attach Id parameter to the "operator/article/article attachment.asp" endpoint. For the second vector, the XSS occurs in a forced SQL error message.

Recommendations For versions prior to 1.95.228, update to version 1.95.228 or later to resolve the issue. As a temporary workaround, consider restricting access to the txtSearch parameter in the "operator/article/article search results.asp" endpoint and the Attach Id parameter in the "operator/article/article attachment.asp" endpoint until a patch is available. Avoid using the txtSearch and Attach Id parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0605

Affected Products

Astrosoft Helpdesk

References · 7

• 🔥 https://exploit-db.com/exploits/31103 · Exploit
• 🔥 https://exploit-db.com/exploits/31104 · Exploit
• 🔥 http://securityfocus.com/bid/27610 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0605 · Security Note
• http://securityfocus.com/archive/1/487487/100/0/threaded · Note
• http://securityreason.com/securityalert/3612 · Note
• http://securityfocus.com/archive/1/488107/100/0/threaded · Note