Kayako SupportSuite and eSupport 'functions_ticketsui.php' Cross Site Scripting Vulnerability

Bugtraq ID:	36568
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 01 2009 12:00AM
Updated:	Oct 01 2009 10:50PM
Credit:	Kayako
Vulnerable:	Kayako SupportSuite 3.60.4 Kayako SupportSuite 3.30.2 Kayako SupportSuite 3.30 Release Candidate 3 Kayako SupportSuite 3.30 Release Candidate 2 Kayako SupportSuite 3.4.10 Kayako SupportSuite 3.0.32 Kayako SupportSuite 3.0.13 Kayako SupportSuite 3.0 0.26 Kayako eSupport 3.60.4 Kayako eSupport 3.20.2 Kayako eSupport 3.0.90 Kayako eSupport 2.3.5 Kayako eSupport 2.3.1 Kayako eSupport 2.3 Kayako eSupport 2.2.5 Kayako eSupport 2.2 Kayako eSupport 2.1.8 Kayako eSupport 2.1.2 Kayako eSupport 0
Not Vulnerable:

Kayako SupportSuite and eSupport 'functions_ticketsui.php' Cross Site Scripting Vulnerability

Kayako SupportSuite and eSupport are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Kayako SupportSuite and eSupport 3.60.04 and prior are vulnerable.

Kayako SupportSuite and eSupport 'functions_ticketsui.php' Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Kayako SupportSuite and eSupport 'functions_ticketsui.php' Cross Site Scripting Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Kayako SupportSuite and eSupport 'functions_ticketsui.php' Cross Site Scripting Vulnerability

References:

• Security bulletin �?? SupportSuite and eSupport (Kayako)