CVE-2007-5727

CVE-2007-5727 describes an incomplete blacklist vulnerability in OneOrZero Helpdesk (common.php, stripScripts) that allows remote XSS via the description parameter to tcreate.php or tupdate.php (e.g., using an onmouseover event in a tag). Affected versions include 1.6.5.4 and 1.6.4.2, with poten...

OneOrZero Helpdesk以不安全方式生成口令漏洞

OneOrZero Helpdesk是一个PHP/MySQL帮助桌面软件。 OneOrZero生成访问口令的方式上存在漏洞，攻击者可以利用此漏洞推测出自动生成的口令。 OneOrZero的forgot password函数会在回答完安全问题后重置口令，默认下这个口令为空。用户可以通过重置管理员口令并保持回答为空强制重置口令。但是，由于口令重置函数是基于用户名和服务器时间来设置口令的，因此可以通过服务器的时间来判断所设置的口令。 OneOrZero OneOrZero 1.6.0 - 1.6.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2006-5474

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset...

CVE-2006-5474

The CVE-2006-5474 entry concerns OneOrZero Helpdesk versions before 1.6.5.4. Root cause: the forgot-password function generates passwords by concatenating the current timestamp with the username, enabling remote attackers to gain access to an arbitrary user via a password reset request. Impact: u...

OneOrZero Helpdesk V1.6.4.1 susceptible to SQL injection and XSS

vendor: http://www.oneorzero.com/ vuln : http://host/supporter/index.php?t=tupd&id=SQL http://host/supporter/index.php?t=tupd&id=XSS Author : Vampire [email protected] Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran HackerZ Security Team...

[SA19446] OneOrZero "id" SQL Injection Vulnerability

TITLE: OneOrZero "id" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19446 VERIFY ADVISORY: http://secunia.com/advisories/19446/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: OneOrZero Helpdesk 1.x http://secunia.com/product/1568/ DESCRIPTION: Preddy...

OneOrZero 1.6.3 Helpdesk - index.php SQL Injection

OneOrZero 1.6.3 Helpdesk - index.php SQL Injection source: https://www.securityfocus.com/bid/17298/info OneOrZero Helpdesk is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...

OneOrZero 1.6.3 Helpdesk - 'index.php' SQL Injection

source: https://www.securityfocus.com/bid/17298/info OneOrZero Helpdesk is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromis...

OneOrZero Helpdesk tupdate.php sg Parameter SQL Injection

The remote host is running OneOrZero, an online helpdesk. There are multiple flaws in this software that could allow an attacker to insert arbitrary SQL commands in the remote database, or even to gain administrative privileges on this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Re...

OneOrZero Helpdesk 1.4 - 'install.php' Administrative Access

source: https://www.securityfocus.com/bid/7611/info OneOrZero Helpdesk has been reported prone to an issue that may result in an attacker obtaining unauthorized administrative access. The issue presents itself due to a programming error in a Helpdesk script. Reportedly a script does not...

OneOrZero Helpdesk 1.4 - 'TUpdate.php' SQL Injection

source: https://www.securityfocus.com/bid/7609/info An SQL injection issue has been reported to affect OneOrZero Helpdesk. The error presents itself in a OneOrZero Helpdesk script that fails to sufficiently sanitize user-supplied input before including it in SQL queries. Successful exploitation...

OneOrZero Helpdesk 1.4 - TUpdate.php SQL Injection

OneOrZero Helpdesk 1.4 - TUpdate.php SQL Injection source: https://www.securityfocus.com/bid/7609/info An SQL injection issue has been reported to affect OneOrZero Helpdesk. The error presents itself in a OneOrZero Helpdesk script that fails to sufficiently sanitize user-supplied input before...

OneOrZero Helpdesk 1.4 - install.php Administrative Access

OneOrZero Helpdesk 1.4 - install.php Administrative Access source: https://www.securityfocus.com/bid/7611/info OneOrZero Helpdesk has been reported prone to an issue that may result in an attacker obtaining unauthorized administrative access. The issue presents itself due to a programming error i...