CVE-2010-1905

Consona Live Assistance - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl parameter to sdccommon/verify/asp/n6plugindestructor.asp.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Ruben Santamarta · textwebappsasp

https://www.exploit-db.com/exploits/33959

View Code ZIP pw:eip

References (7)

[Vendor Advisory] http://secunia.com/advisories/39740

[Various Sources] http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html

[Patch, Vendor Advisory] http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf

[Patch, US Government Resource] http://www.kb.cert.org/vuls/id/602801

[Exploit] http://www.securityfocus.com/bid/39999

[Exploit] http://www.wintercore.com/downloads/rootedcon_0day.pdf

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/511176/100/0/threaded

Scores

EPSS 0.0329

EPSS Percentile 87.0%

Classification

CWE

CWE-79

Status published

Affected Products (6)

consona/consona_live_assistance

consona/consona_dynamic_agent

consona/consona_dynamic_agent

consona/consona_dynamic_agent

consona/consona_subscriber_assistance

n/a/n/a

Timeline

Published May 12, 2010

Tracked Since Feb 18, 2026