ID de Prueba:	1.3.6.1.4.1.25623.1.0.902530
Categoría:	Web application abuses
Título:	ActivDesk Multiple Cross Site Scripting and SQL Injection Vulnerabilities
Resumen:	This host is running ActivDesk and is prone to multiple cross site; scripting and SQL injection vulnerabilities.
Descripción:	Summary: This host is running ActivDesk and is prone to multiple cross site scripting and SQL injection vulnerabilities. Vulnerability Insight: Multiple flaws are due to - Improper validation of user-supplied input passed to the 'keywords0', 'keywords1', 'keywords2' and 'keywords3' parameters in search.cgi, which allows attackers to execute arbitrary HTML and script code on the web server. - Improper validation of user-supplied input passed to the 'cid' parameter in kbcat.cgi and the 'kid' parameter in kb.cgi, which allows attacker to manipulate SQL queries by injecting arbitrary SQL code. Vulnerability Impact: Successful exploitation allows an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Affected Software/OS: ActivDesk version 3.0 and prior. Solution: Upgrade to ActivDesk version 3.0.1 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	BugTraq ID: 46937 Common Vulnerability Exposure (CVE) ID: CVE-2011-1563 http://www.securityfocus.com/bid/46937 http://www.exploit-db.com/exploits/17025 http://aluigi.org/adv/realwin_2-adv.txt http://aluigi.org/adv/realwin_3-adv.txt http://aluigi.org/adv/realwin_4-adv.txt http://aluigi.org/adv/realwin_5-adv.txt http://aluigi.org/adv/realwin_7-adv.txt http://aluigi.org/adv/realwin_8-adv.txt http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-080-04.pdf http://secunia.com/advisories/43848 http://securityreason.com/securityalert/8176 http://www.vupen.com/english/advisories/2011/0742 Common Vulnerability Exposure (CVE) ID: CVE-2011-1564 http://aluigi.org/adv/realwin_6-adv.txt http://securityreason.com/securityalert/8177
Copyright	Copyright (C) 2011 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.