CVE-2006-6998

CVE-2006-6998 affects Headstart Solutions DeskPRO. The vulnerable file is install/loader_help.php, which can be accessed with a q=phpinfo QUERY_STRING to trigger phpinfo, allowing remote attackers to obtain configuration information. Documented impact is Partial Confidentiality with no integrity/...

CVE-2006-6974

Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 list files in the includes/ directory; obtain the SQL username and password via a direct request for 2 config.php and 3 config.php.bak in includes/; rea...

CVE-2006-6973

Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to 1 reinstall the application via a direct request for install/index.php; 2 delete the database via a do=deletedatabase QUERYSTRI...

CVE-2006-6973

Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to 1 reinstall the application via a direct request for install/index.php; 2 delete the database via a do=deletedatabase QUERYSTRI...

CVE-2006-6974

The CVE-2006-6974 entry concerns Headstart Solutions DeskPRO, where sensitive data is stored under the web root with insufficient access control. According to the sources, an attacker can directly request various files in includes/ (config.php, config.php.bak, and other includes/), read files in ...

CVE-2006-6159

Multiple cross-site scripting XSS vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 message or 2 subject parameter...

CVE-2006-6159

CVE-2006-6159 describes multiple cross-site scripting (XSS) vulnerabilities in DeskPRO 2.0.0 and 2.0.1, exploitable via the message or subject parameters in newticket.php. The underlying issue is that remote attackers can inject arbitrary web script or HTML. The CVSS basis is 6.8 (Medium), with n...

CVE-2006-6159

Multiple cross-site scripting XSS vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 message or 2 subject parameter...

CVE-2003-0874

Multiple SQL injection vulnerabilities in DeskPRO 1.1.0 and earlier allow remote attackers to insert arbitrary SQL and conduct unauthorized activities via 1 the cat parameter in faq.php, 2 the article parameter in faq.php, 3 the tickedid parameter in view.php, and 4 the Password entry on the logo...

CVE-2003-0874

Multiple SQL injection vulnerabilities in DeskPRO 1.1.0 and earlier allow remote attackers to insert arbitrary SQL and conduct unauthorized activities via 1 the cat parameter in faq.php, 2 the article parameter in faq.php, 3 the tickedid parameter in view.php, and 4 the Password entry on the logo...

CVE-2003-0874

CVE-2003-0874 affects DeskPRO 1.1.0 and earlier. The vulnerability arises from multiple SQL injection vectors, including cat and article parameters in faq.php, tickedid in view.php, and the Password field on the logon screen. The underlying issue is improper input handling that allows an attacker...

Multiple SQL Injection Vulnerabilities in DeskPRO

Multiple SQL Injection Vulnerabilities in DeskPRO ------------------------------------------------------------------------- Article reference: http://www.securiteam.com/unixfocus/6R0052K8KM.html SUMMARY DeskPRO http://www.deskpro.com is "an integrated script to manage your customer sales and...

deskpro.sql.txt

Multiple SQL Injection Vulnerabilities in DeskPRO ------------------------------------------------------------------------- Article reference: http://www.securiteam.com/unixfocus/6R0052K8KM.html SUMMARY DeskPRO http://www.deskpro.com is "an integrated script to manage your customer sales and...

DeskPro 1.1 - Multiple SQL Injections

DeskPro 1.1 - Multiple SQL Injections source: https://www.securityfocus.com/bid/8856/info It has been reported that DeskPro is prone to multiple SQL injection vulnerabilities due to insufficient sanitization of user-supplied input. The problem is reported to be present in various parameters such ...

DeskPro 1.1 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/8856/info It has been reported that DeskPro is prone to multiple SQL injection vulnerabilities due to insufficient sanitization of user-supplied input. The problem is reported to be present in various parameters such as cat, article, and ticketid of the...