IDevSpot iSupport Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	19963
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 12 2006 12:00AM
Updated:	Sep 16 2006 12:02AM
Credit:	s3rv3r_hack3r is credited with the discovery of these vulnerabilities.
Vulnerable:	IDevSpot iSupport 1.8
Not Vulnerable:

IDevSpot iSupport Multiple Cross-Site Scripting Vulnerabilities

IDevSpot iSupport is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 1.8 is vulnerable; other versions may also be affected.

IDevSpot iSupport Multiple Cross-Site Scripting Vulnerabilities

An attacker can exploit these issues via a web client.

The following URIs are avaialble:

http://www.example.com/isupport/support/rightbar.php?suser=[xss]

http://www.example.com/isupport/support/open_tickets.php?ticket_id=[xss]

http://www.example.com/isupport/index.php?cons_page_title=[xss]

s3rv3r_hack3r

IDevSpot iSupport Multiple Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

IDevSpot iSupport Multiple Cross-Site Scripting Vulnerabilities

References:

• iSupport Homepage (IDevSpot)