CVE-2005-2460

Kayako liveResponse 2.x - Cross-Site Scripting via Username Parameter or Name Field

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-2460. PoCs published by GulfTech Security.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Kayako LiveResponse by injecting a script tag into the 'username' parameter. The PoC shows how an attacker could steal cookie-based authentication credentials.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Kayako liveResponse 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter or (2) name field when entering a session or sending a message.

Exploits (1)

exploitdb WORKING POC VERIFIED

by GulfTech Security · textwebappsphp

https://www.exploit-db.com/exploits/26051

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Kayako LiveResponse by injecting a script tag into the 'username' parameter. The PoC shows how an attacker could steal cookie-based authentication credentials.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Kayako LiveResponse

No auth needed

Prerequisites: Access to the vulnerable web application

MITRE ATT&CK