CVE-2006-6973: Undefined Security Weakness

Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to 1 reinstall the application via a direct request for install/index.php; 2 delete the database via a do=deletedatabase QUERYSTRI...

CVE-2006-6974: Undefined Security Weakness

Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 list files in the includes/ directory; obtain the SQL username and password via a direct request for 2 config.php and 3 config.php.bak in includes/; rea...

CVE-2006-6159

Multiple cross-site scripting XSS vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 message or 2 subject parameter...

CVE-2006-6159

Multiple cross-site scripting XSS vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 message or 2 subject parameter...

CVE-2006-6159

CVE-2006-6159 describes multiple cross-site scripting (XSS) vulnerabilities in DeskPRO 2.0.0 and 2.0.1, exploitable via the message or subject parameters in newticket.php. The underlying issue is that remote attackers can inject arbitrary web script or HTML. The CVSS basis is 6.8 (Medium), with n...

CVE-2006-6159: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 message or 2 subject parameter...

CVE-2003-0874

Multiple SQL injection vulnerabilities in DeskPRO 1.1.0 and earlier allow remote attackers to insert arbitrary SQL and conduct unauthorized activities via 1 the cat parameter in faq.php, 2 the article parameter in faq.php, 3 the tickedid parameter in view.php, and 4 the Password entry on the logo...

CVE-2003-0874

Multiple SQL injection vulnerabilities in DeskPRO 1.1.0 and earlier allow remote attackers to insert arbitrary SQL and conduct unauthorized activities via 1 the cat parameter in faq.php, 2 the article parameter in faq.php, 3 the tickedid parameter in view.php, and 4 the Password entry on the logo...

CVE-2003-0874

CVE-2003-0874 affects DeskPRO 1.1.0 and earlier. The vulnerability arises from multiple SQL injection vectors, including cat and article parameters in faq.php, tickedid in view.php, and the Password field on the logon screen. The underlying issue is improper input handling that allows an attacker...

CVE-2003-0874: Undefined Security Weakness

Multiple SQL injection vulnerabilities in DeskPRO 1.1.0 and earlier allow remote attackers to insert arbitrary SQL and conduct unauthorized activities via 1 the cat parameter in faq.php, 2 the article parameter in faq.php, 3 the tickedid parameter in view.php, and 4 the Password entry on the logo...

Multiple SQL Injection Vulnerabilities in DeskPRO

Multiple SQL Injection Vulnerabilities in DeskPRO ------------------------------------------------------------------------- Article reference: http://www.securiteam.com/unixfocus/6R0052K8KM.html SUMMARY DeskPRO http://www.deskpro.com is "an integrated script to manage your customer sales and...

deskpro.sql.txt

Multiple SQL Injection Vulnerabilities in DeskPRO ------------------------------------------------------------------------- Article reference: http://www.securiteam.com/unixfocus/6R0052K8KM.html SUMMARY DeskPRO http://www.deskpro.com is "an integrated script to manage your customer sales and...

DeskPro 1.1 - Multiple SQL Injections

DeskPro 1.1 - Multiple SQL Injections source: https://www.securityfocus.com/bid/8856/info It has been reported that DeskPro is prone to multiple SQL injection vulnerabilities due to insufficient sanitization of user-supplied input. The problem is reported to be present in various parameters such ...

DeskPro 1.1 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/8856/info It has been reported that DeskPro is prone to multiple SQL injection vulnerabilities due to insufficient sanitization of user-supplied input. The problem is reported to be present in various parameters such as cat, article, and ticketid of the...