CVE-2008-3700

Kayako SupportSuite <3.20.02 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the sessionid parameter in a livesupport startclientchat action to visitor/index.php; (2) the filter parameter in a news view action to index.php; or the Full Name field in a (3) account creation, (4) ticket opening, or (5) chat request operation.

Exploits (2)

exploitdb WORKING POC VERIFIED

by GulfTech Security · textwebappsphp

https://www.exploit-db.com/exploits/32220

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by GulfTech Security · textwebappsphp

https://www.exploit-db.com/exploits/32219

View Code ZIP pw:eip

References (9)

[Various Sources] http://forums.kayako.com/f3/3-30-00-stable-released-18304/

[Third Party Advisory, VDB Entry] http://osvdb.org/47613

[Third Party Advisory, VDB Entry] http://osvdb.org/47614

[Third Party Advisory, VDB Entry] http://osvdb.org/47615

[Vendor Advisory] http://secunia.com/advisories/31431

[Various Sources] http://www.gulftech.org/?node=research&article_id=00123-08092008

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/44382

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/44383

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/30642

Scores

EPSS 0.0326

EPSS Percentile 87.0%

Classification

CWE

CWE-79

Status draft

Affected Products (5)

kayako/supportsuite < 3.20.02

kayako/supportsuite

kayako/supportsuite

kayako/supportsuite

kayako/supportsuite

Timeline

Published Aug 15, 2008

Tracked Since Feb 18, 2026