Information disclosure

moveuploadedfile.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message...

CVE-2011-5071

Support Incident Tracker (SiT!) is affected by multiple SQL injection vulnerabilities in versions prior to 3.64 (and cited remotely as SiT!

CVE-2011-5068

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via userdelete.php and other unspecified programs...

CVE-2011-5069

CVE-2011-5069 is an Unrestricted file upload vulnerability in Support Incident Tracker (SiT!) 3.65, specifically in incident_attachments.php. The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct r...

CVE-2011-5068

CVE-2011-5068 affects Support Incident Tracker (SiT!) version 3.65, with multiple CSRF vulnerabilities that allow remote attackers to hijack a user’s authenticated session for actions such as deleting a user via user_delete.php and other unspecified programs. The connected documents confirm the v...

CVE-2011-5067

CVE-2011-5067 affects Support Incident Tracker (SiT!) 3.65. The vulnerability is in the move_uploaded_file.php component, where remote authenticated users can disclose the installation path by an error message that includes the file name. The documented impact is partial information disclosure; n...

CVE-2011-3831

CVE-2011-3831 affects Support Incident Tracker (SiT!) 3.65. The vulnerability is an SQL injection in incident_attachments.php that allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name. This is documented across multiple sources (NVD/NVD listing, ...

CVE-2011-3830

CVE-2011-3830 affects Support Incident Tracker (SiT!) 3.65, where an XSS flaw exists in search.php via the search_string parameter, enabling remote injection of arbitrary script/HTML. Root cause is insufficient input validation on the search_string field, as reported in the NVD entry. Exploitatio...

CVE-2011-3833

CVE-2011-3833 affects Support Incident Tracker (SiT!) 3.65, with an Unrestricted file upload in ftp_upload_file.php. The root cause is that remote authenticated users can upload a PHP file and access it via a direct request to that file in an unspecified directory, enabling arbitrary code executi...

CVE-2011-3832

SiT! (Support Incident Tracker) 3.65 is affected by an eval/code-injection vulnerability in config.php. The issue allows remote authenticated administrators to execute arbitrary PHP code via the application_name parameter during a save action, due to the use of an eval-like construct in evaluatin...

CVE-2011-3829

CVE-2011-3829 affects Support Incident Tracker (SiT!)

CVE-2011-5070

CVE-2011-5070: Several XSS vulnerabilities in Support Incident Tracker (SiT!) 3.65 allow remote attackers to inject arbitrary web script/HTML via (1) incident_attachments.php file name, (2) vectors in link_add.php (origref, linkref, linktype) or the redirect parameter in html_redirect, and (3) tr...

CVE-2011-5069

Unrestricted file upload vulnerability in incidentattachments.php in Support Incident Tracker aka SiT! 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in unspecified directory, a...

Support Incident Tracker multiple vulnerabilities

Overview Support Incident Tracker or SiT! version 3.65, and possibly earlier versions, contain multiple vulnerabilities including; malicious file uploads, SQL injection, cross-site scripting, and cross-site request forgery. Description According to the SiT! website:"Support Incident Tracker or Si...

Support Incident Tracker (SiT!) Multiple Input Validation Vulnerabilities

Support Incident Tracker SiT! is prone to the following input- validation vulnerabilities: 1. A cross-site scripting vulnerability 2. An SQL-injection vulnerability 3. A PHP code-injection vulnerability 4. A path-disclosure vulnerability 5. An arbitrary-file-upload vulnerability Exploiting these...

Support Incident Tracker (SiT!) <= 3.65 Multiple Vulnerabilities

Support Incident Tracker SiT! is prone to multiple vulnerabilities. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Multiple vulnerabilities in SiT! Support Incident Tracker

Vulnerability ID: HTB23043 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinsitsupportincidenttracker.html Product: SiT! Support Incident Tracker Vendor: The Support Incident Tracker Project http://sitracker.org/ Vulnerable Version: 3.64 and probably prior Tested Version: 3.64...

SiT! Support Incident Tracker 3.64 XSS / XSRF / SQL Injection

Vulnerability ID: HTB23043 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinsitsupportincidenttracker.html Product: SiT! Support Incident Tracker Vendor: The Support Incident Tracker Project http://sitracker.org/ Vulnerable Version: 3.64 and probably prior Tested Version: 3.64...

Multiple Vulnerabilities in SiT! Support Incident Tracker

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SiT! Support Incident Tracker, which can be exploited to perform cross-site scripting, cross-site request forgery and SQL injection attacks. 1 Cross-site scripting XSS vulnerabilities in SiT! Support Incident...

[PT-2011-25] SQL injection vulnerabilities in Support Incident Tracker

---------------------------------------------------------------------- PT-2011-25 Positive Technologies Security Advisory SQL injection vulnerabilities in Support Incident Tracker ---------------------------------------------------------------------- --- Vulnerable software SiT! Version 3.63p1 an...