20020610 [ARL02-A15] Multiple Security Issues in MyHelpdeskmailing list
http://archives.neohapsis.com/archives/bugtraq/2002-06/0057.html CVE-2002-0931
MyHelpDesk 20020509 - HTML Injection
Record summary
CVE-2002-0931 has a selected CVSS score of 7.5; EIP currently links 2 catalogued exploits.
Description
Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to execute script as other users via a (1) Title or (2) Description when a new ticket is created by a support assistant, via the "id" parameter to the index.php script with the (3) tickettime, (4) ticketfiles, or (5) updateticketlog operations, or (6) via the update section when a ticket is edited.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 2
Proofs of concept
2Catalogued exploits
ExploitDBMyHelpDesk 20020509 - HTML InjectionExploitDB exploitby Ahmet Sabri ALPERNot analyzed1 file
ExploitDBMyHelpDesk 20020509 - Cross-Site ScriptingExploitDB exploitby Ahmet Sabri ALPERNot analyzed1 file
References
6myhelpdesk-new-ticket-xss(9319)vdb entry
http://www.iss.net/security_center/static/9319.php myhelpdesk-index-php-xss(9320)vdb entry
http://www.iss.net/security_center/static/9320.php 4967vdb entry
http://www.securityfocus.com/bid/4967 4970vdb entry
http://www.securityfocus.com/bid/4970 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2002-0931