CVE-2005-4637
Kayako SupportSuite <= 3.00.26 - Cross-Site Scripting via Multiple Input Fields
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-4637. PoCs published by r0t3d3Vil.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Kayako SupportSuite versions 3.00.26 and prior. It includes a sample URL demonstrating how an attacker could inject arbitrary script code via the 'nav' parameter.
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) nav parameter in the downloads module, (2) Full Name and (3) Email fields in the core module, (4) Full Name, (5) Email, and (6) Subject fields in the tickets module, or (7) Registered Email field in the lostpassword feature in the core module.
Exploits (1)
The provided text describes a cross-site scripting (XSS) vulnerability in Kayako SupportSuite versions 3.00.26 and prior. It includes a sample URL demonstrating how an attacker could inject arbitrary script code via the 'nav' parameter.