high7.5Public exploit code
CVE-2002-0931
Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to execute script as other users via a (1) Ti…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MyHelpDesk 20020509 - Cross-Site Scripting2002-06-10 · webapps · php · Verified
- MyHelpDesk 20020509 - HTML Injection2002-06-10 · webapps · php · Verified
Impact
Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to execute script as other users via a (1) Title or (2) Description when a new ticket is created by a support assistant, via the "id" parameter to the index.php script with the (3) tickettime, (4) ticketfiles, or (5) updateticketlog operations, or (6) via the update section when a ticket is edited.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Luis Bernardo | Myhelpdesk | through 2002-05-09 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2002-06/0057.html
- http://www.iss.net/security_center/static/9319.php
- http://www.iss.net/security_center/static/9320.php
- http://www.securityfocus.com/bid/4967
- http://www.securityfocus.com/bid/4970
- http://archives.neohapsis.com/archives/bugtraq/2002-06/0057.html
- http://www.iss.net/security_center/static/9319.php
- http://www.iss.net/security_center/static/9320.php
- http://www.securityfocus.com/bid/4967
- http://www.securityfocus.com/bid/4970