LeighBusinessEnterprisesWebHelpDeskSQL注入漏洞

LBE Web Helpdesk是一款可通过WEB浏览器进行操作的Helpdesk系统。LBE Web Helpdesk不正确过滤用户提交的数据，远程攻击者可以利用这个漏洞进行SQL注入攻击，可能获得敏感数据或修改数据库。问题存在于jobedit.asp脚本对用户提交给'id'参数缺少过滤，提交包含恶意SQL命令的数据作为'id'参数，可修改'users'表，增加操作员相等权限的新用户。 Leigh Business Enterprises Web HelpDesk 4.0.0.80 临时解决方法：如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 在$nick...

CVE-2006-6380

Cross-site scripting XSS vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter...

CVE-2006-6381

Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2006-6381

The CVE-2006-6381 entry describes a directory traversal vulnerability in Ultimate HelpDesk, specifically in getfile.asp, where remote attackers can read arbitrary files by supplying a .. (dot dot) in the filename parameter. The affected software/component is Ultimate HelpDesk (getfile.asp). Root ...

CVE-2006-6381

Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2006-6380

Cross-site scripting XSS vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter...

CVE-2006-6380

CVE-2006-6380 concerns a Cross-site Scripting (XSS) vulnerability in Ultimate HelpDesk’s index.asp, exploitable via the keyword parameter. The issue allows remote attackers to inject arbitrary web script or HTML into the page, with the potential to affect users’ sessions and data depending on the...

CVE-2006-6366

Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...

CVE-2006-6366

Cross-site scripting XSS vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details ar...

CVE-2006-6366

Cerberus Helpdesk is affected by a Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php. The js parameter can be exploited to inject arbitrary script/HTML in versions 0.97.3, 2.0–2.7, 3.2.1, and 3.3. This is a remote issue described in the CVE entry; exploitation ...

timate HelpDesk (XSS/Local File Disclosure) Vulnerabilities

No description provided by source. Title : Ultimate HelpDesk All Version Source/XSS Vulnerabilities Author : ajann Contact : : Login Before Vulnerabilities.: SOURCE------------------------------------------------------ http://target/path//getfile.asp?filename=SQL Example:...

Cerberus Helpdesk 2.x - Spellwin.php Cross-Site Scripting

Cerberus Helpdesk 2.x - Spellwin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/21423/info Cerberus Helpdesk is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have...

Cerberus Helpdesk 2.x - 'Spellwin.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21423/info Cerberus Helpdesk is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecti...

Ultimate HelpDesk All Version (Source/XSS) Vulnerabilities

Title : Ultimate HelpDesk All Version Source/XSS Vulnerabilities Author : ajann Contact : : Login Before Vulnerabilities.: SOURCE------------------------------------------------------ http://target/path//getfile.asp?filename=SQL Example: //getfile.asp?filename=../index.asp...

Ultimate HelpDesk (XSS/Local File Disclosure) Vulnerabilities

Exploit for unknown platform in category web applications ============================================================= Ultimate HelpDesk XSS/Local File Disclosure Vulnerabilities ============================================================= Title : Ultimate HelpDesk All Version Source/XSS...

Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure

Title : Ultimate HelpDesk All Version Source/XSS Vulnerabilities Author : ajann Contact : : Login Before Vulnerabilities.: SOURCE------------------------------------------------------ http://target/path//getfile.asp?filename=SQL Example: //getfile.asp?filename=../index.asp...

Ultimate HelpDesk - Cross-Site Scripting Local File Disclosure

Ultimate HelpDesk - Cross-Site Scripting Local File Disclosure Title : Ultimate HelpDesk All Version Source/XSS Vulnerabilities Author : ajann Contact : : Login Before Vulnerabilities.: SOURCE------------------------------------------------------ http://target/path//getfile.asp?filename=SQL...

Ultimate HelpDesk (XSS/Local File Disclosure) Vulnerabilities

No description provided by source. Title : Ultimate HelpDesk All Version Source/XSS Vulnerabilities Author : ajann Contact : : Login Before Vulnerabilities.: SOURCE------------------------------------------------------ http://target/path//getfile.asp?filename=SQL Example:...

CVE-2006-6158

Multiple cross-site scripting XSS vulnerabilities in a PMOS Help Desk 2.4, formerly b InverseFlow Help Desk 2.31 and also sold as c Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the 1 id or email parameter to ticketview.php, or 2 the email parameter to...

CVE-2006-6158

Multiple cross-site scripting XSS vulnerabilities in a PMOS Help Desk 2.4, formerly b InverseFlow Help Desk 2.31 and also sold as c Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the 1 id or email parameter to ticketview.php, or 2 the email parameter to...