Virtual Support Office-XP Multiple Remote Vulnerabilities
BID:29841
Info
Virtual Support Office-XP Multiple Remote Vulnerabilities
| Bugtraq ID: | 29841 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 20 2008 12:00AM |
| Updated: | Jun 23 2008 07:51PM |
| Credit: | AmnPardaz Security Research Team |
| Vulnerable: |
Advanced Control Systems Virtual Support Office-XP 3.0 |
| Not Vulnerable: | |
Discussion
Virtual Support Office-XP Multiple Remote Vulnerabilities
Virtual Support Office-XP is prone to multiple remote vulnerabilities, including:
- multiple unauthorized-access vulnerabilities
- multiple cross-site scripting vulnerabilities
- multiple SQL-injection vulnerabilities
- an arbitrary-file-upload vulnerability
Exploiting these issues could allow an attacker to upload arbitrary files onto the webserver, steal cookie-based authentication credentials, compromise the application, access or modify data, create or delete folders on the webserver, or exploit latent vulnerabilities in the underlying database.
Virtual Support Office-XP 3.0.29 and 3.0.27 are vulnerable; other versions may also be affected.
Virtual Support Office-XP is prone to multiple remote vulnerabilities, including:
- multiple unauthorized-access vulnerabilities
- multiple cross-site scripting vulnerabilities
- multiple SQL-injection vulnerabilities
- an arbitrary-file-upload vulnerability
Exploiting these issues could allow an attacker to upload arbitrary files onto the webserver, steal cookie-based authentication credentials, compromise the application, access or modify data, create or delete folders on the webserver, or exploit latent vulnerabilities in the underlying database.
Virtual Support Office-XP 3.0.29 and 3.0.27 are vulnerable; other versions may also be affected.
Exploit / POC
Virtual Support Office-XP Multiple Remote Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following exploit examples are available:
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following exploit examples are available:
Solution / Fix
Virtual Support Office-XP Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Virtual Support Office-XP Multiple Remote Vulnerabilities
References:
References:
- Virtual Support Office-XP Homepage (Advanced Data Solutions)