CVE-2008-3700

EPSS 4.1%

Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the sessionid parameter in a livesupport startclientchat action to visitor/index.php; (2) the filter parameter in a news view action to index.php; or the Full Name field in a (3) account creation, (4) ticket opening, or (5) chat request operation.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/32219unverified exploitdbwww.exploit-db.com/exploits/32220unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://forums.kayako.com/f3/3-30-00-stable-released-18304/http://osvdb.org/47613 http://osvdb.org/47614 http://osvdb.org/47615 http://secunia.com/advisories/31431 https://exchange.xforce.ibmcloud.com/vulnerabilities/44382 https://exchange.xforce.ibmcloud.com/vulnerabilities/44383 http://www.gulftech.org/?node=research&article_id=00123-08092008 http://www.securityfocus.com/bid/30642