PT-2012-2158 · Clickdesk · Clickdesk Live Support

Published 2012-09-20 · Updated 2018-10-09 · CVE-2011-5181

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ClickDesk Live Support - Live Chat plugin version 2.0

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter in the clickdesk.php file. This could potentially lead to malicious actions on the affected website.

Recommendations For ClickDesk Live Support - Live Chat plugin version 2.0, avoid using the cdwidgetid parameter in the clickdesk.php file until a fix is available. Consider restricting access to this parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-5181

Affected Products

Clickdesk Live Support

References · 8

• 🔥 http://securityfocus.com/bid/50778 · Exploit
• 🔥 http://osvdb.org/77338 · Exploit
• 🔥 https://exploit-db.com/exploits/36338 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5181 · Security Note
• http://securityfocus.com/archive/1/520624/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71469 · Note
• http://wordpress.org/extend/plugins/clickdesk-live-support-chat-plugin/changelog · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5181 · Note