Cerberus Helpdesk 2.7 - 'Clients.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16439/info Cerberus Helpdesk is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the...

Cerberus Helpdesk vulnerable to XSS

Inputs in the Cerberus Helpdesk is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters. You can add XSS that will hit every user of the system, and even simple scripting tags like scriptalert‘f’/script is allowed PoC:...

Cerberus Helpdesk GUI Agent < 2.7.1 Multiple Remote Vulnerabilities (SQLi, XSS)

The remote host is running Cerberus Helpdesk, a web-based helpdesk suite written in PHP. The installed version of Cerberus Helpdesk is affected by several SQL injection issues and one cross-site scripting flaw because of its failure to sanitize user-supplied input to various parameters and script...

Cerberus Helpdesk 2.649 - addresses_export.php?queues SQL Injection

Cerberus Helpdesk 2.649 - addressesexport.php?queues SQL Injection source: https://www.securityfocus.com/bid/16062/info Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that...

Cerberus Helpdesk 2.649 - display_ticket_thread.php?ticket SQL Injection

Cerberus Helpdesk 2.649 - displayticketthread.php?ticket SQL Injection source: https://www.securityfocus.com/bid/16062/info Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input th...

cerberusHelp.txt

Title: Cerberus Helpdesk multiple vulnerabilities. Severity: Medium Affected: cerberus-gui 2.649, support-center 2.6493.2.0pr2 Problem type: remote Author: Alejandro Ramos Description: ------------------------------------------------------------------------------- Cerberus Helpdesk is a WebGroup...

Cerberus Helpdesk 2.649 - 'addresses_export.php?queues' SQL Injection

source: https://www.securityfocus.com/bid/16062/info Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that will be included in site output or in SQL queries. The cross-site...

Cerberus Helpdesk 2.649 - 'cer_KnowledgebaseHandler.class.php?_load_article_details' SQL Injection

source: https://www.securityfocus.com/bid/16062/info Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that will be included in site output or in SQL queries. The cross-site...

Cerberus Helpdesk 2.649 - 'display_ticket_thread.php?ticket' SQL Injection

source: https://www.securityfocus.com/bid/16062/info Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that will be included in site output or in SQL queries. The cross-site...

Cerberus Helpdesk 2.649 - cer_KnowledgebaseHandler.class.php?_load_article_details SQL Injection

Cerberus Helpdesk 2.649 - cerKnowledgebaseHandler.class.php?loadarticledetails SQL Injection source: https://www.securityfocus.com/bid/16062/info Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of...

CVE-2005-4428

Cross-site scripting XSS vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kbask parameter...

CVE-2005-4427

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the 1 fileid parameter to attachmentsend.php, 2 the $addy variable in emailparser.php, 3 $address variable in emailparser.php, 4 $aaddress variable in structs.php, 5 kbid...

CVE-2005-4427

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the 1 fileid parameter to attachmentsend.php, 2 the $addy variable in emailparser.php, 3 $address variable in emailparser.php, 4 $aaddress variable in structs.php, 5 kbid...

CVE-2005-4428

CVE-2005-4428 documents a cross-site scripting (XSS) vulnerability in Cerberus Helpdesk (index.php) that can be exploited via the query parameter kb_ask . The underlying issue is failure to sanitize user input before reflecting it in dynamically-generated HTML, as described in connected Nessus en...

CVE-2005-4427

CVE-2005-4427 corresponds to multiple SQL injection vulnerabilities in Cerberus Helpdesk (a PHP-based web application). The CVE entry covers eight injectable points: (1) file_id in attachment_send.php, (2) $addy in email_parser.php, (3) $address in email_parser.php, (4) $a_address in structs.php,...

CVE-2005-4428

Cross-site scripting XSS vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kbask parameter...

CVE-2005-4428: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kbask parameter...

CVE-2005-4427: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the 1 fileid parameter to attachmentsend.php, 2 the $addy variable in emailparser.php, 3 $address variable in emailparser.php, 4 $aaddress variable in structs.php, 5 kbid...

CVE-2005-3925

Multiple SQL injection vulnerabilities in Central Manchester CLC Helpdesk Issue Manager 0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 detail, 2 orderdir, and 3 orderby parameters to find.php, and the 4 id parameter to issue.php...

CVE-2005-3925

CVE-2005-3925 describes multiple SQL injection vulnerabilities in Central Manchester CLC Helpdesk Issue Manager 0.9 and earlier. The flaws allow remote attackers to execute arbitrary SQL commands through the following inputs: (1) detail[] (2) orderdir (3) orderby to find.php, and (4) id to issue....