CVE-2007-5727

Oneorzero Helpdesk - XSS

Title source: rule

Description

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag.

References (7)

[Vendor Advisory] http://secunia.com/advisories/27415

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/482790/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/26208

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/26217

[Third Party Advisory, VDB Entry] http://osvdb.org/38215

[Third Party Advisory, VDB Entry] http://osvdb.org/38836

[Third Party Advisory] http://securityreason.com/securityalert/3320

Scores

EPSS 0.0057

EPSS Percentile 68.2%

Classification

CWE

CWE-79

Status draft

Affected Products (2)

oneorzero/oneorzero_helpdesk

oneorzero/oneorzero_helpdesk

Timeline

Published Oct 30, 2007

Tracked Since Feb 18, 2026