ID de Prueba:	1.3.6.1.4.1.25623.1.0.902530
Categoría:	Web application abuses
Título:	ActivDesk < 3.0.1 Multiple Vulnerabilities - Active Check
Resumen:	ActivDesk is prone to multiple cross-site scripting (XSS) and; SQL injection (SQLi) vulnerabilities.
Descripción:	Summary: ActivDesk is prone to multiple cross-site scripting (XSS) and SQL injection (SQLi) vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - Improper validation of user-supplied input passed to the 'keywords0', 'keywords1', 'keywords2' and 'keywords3' parameters in search.cgi, which allows attackers to execute arbitrary HTML and script code on the web server. - Improper validation of user-supplied input passed to the 'cid' parameter in kbcat.cgi and the 'kid' parameter in kb.cgi, which allows attacker to manipulate SQL queries by injecting arbitrary SQL code. Vulnerability Impact: Successful exploitation allows an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Affected Software/OS: ActivDesk version 3.0 and prior. Solution: Update to version 3.0.1 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1563 BugTraq ID: 46937 http://www.securityfocus.com/bid/46937 http://www.exploit-db.com/exploits/17025 http://aluigi.org/adv/realwin_2-adv.txt http://aluigi.org/adv/realwin_3-adv.txt http://aluigi.org/adv/realwin_4-adv.txt http://aluigi.org/adv/realwin_5-adv.txt http://aluigi.org/adv/realwin_7-adv.txt http://aluigi.org/adv/realwin_8-adv.txt http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-080-04.pdf http://secunia.com/advisories/43848 http://securityreason.com/securityalert/8176 http://www.vupen.com/english/advisories/2011/0742 Common Vulnerability Exposure (CVE) ID: CVE-2011-1564 http://aluigi.org/adv/realwin_6-adv.txt http://securityreason.com/securityalert/8177
Copyright	Copyright (C) 2011 Greenbone Networks GmbH

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.