medium5.0Public exploit code
CVE-2004-1413
Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the (1) subcat, (2) rate, (3) questi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Kayako eSupport 2.x - Ticket System Multiple SQL Injections2004-12-18 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the (1) subcat, (2) rate, (3) questiondetails, (4) ticketkey22, (5) email22 parameters to index.php, or (6) the e-mail field of the Forgot Key feature.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kayako | Esupport | Versions 2.1.2, 2.1.8, 2.2, 2.2.5, 2.3 |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=110352428607171&w=2
- http://www.gulftech.org/?node=research&article_id=00056-12182004
- http://www.securityfocus.com/bid/12037
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18572
- http://marc.info/?l=bugtraq&m=110352428607171&w=2
- http://www.gulftech.org/?node=research&article_id=00056-12182004
- http://www.securityfocus.com/bid/12037
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18572