Support Incident Tracker CVE-2012-2235 Cross-Site Scripting Vulnerability

Bugtraq ID:	73664
Class:	Input Validation Error
CVE:	CVE-2012-2235
Remote:	Yes
Local:	No
Published:	May 27 2012 12:00AM
Updated:	May 27 2012 12:00AM
Credit:	Unknown
Vulnerable:	Sitracker Support Incident Tracker 4.8 Sitracker Support Incident Tracker 9.8.00 Sitracker Support Incident Tracker 8.8.00 Sitracker Support Incident Tracker 7.8.00 Sitracker Support Incident Tracker 31.07.00 Sitracker Support Incident Tracker 3.65 Sitracker Support Incident Tracker 3.64 Sitracker Support Incident Tracker 3.63 Beta1 Sitracker Support Incident Tracker 3.63 Sitracker Support Incident Tracker 3.62 Sitracker Support Incident Tracker 3.61 Sitracker Support Incident Tracker 3.60 Sitracker Support Incident Tracker 3.6 Sitracker Support Incident Tracker 3.51 Sitracker Support Incident Tracker 3.50 Beta1 Sitracker Support Incident Tracker 3.50 Sitracker Support Incident Tracker 3.45 Beta1 Sitracker Support Incident Tracker 3.45 Sitracker Support Incident Tracker 3.07 Sitracker Support Incident Tracker 3.06 Sitracker Support Incident Tracker 3.05 Sitracker Support Incident Tracker 3.04A Sitracker Support Incident Tracker 3.03A Sitracker Support Incident Tracker 3.03 Sitracker Support Incident Tracker 3.02 Sitracker Support Incident Tracker 3.01 Sitracker Support Incident Tracker 3.00 Beta3 Sitracker Support Incident Tracker 3.00 Beta2 Sitracker Support Incident Tracker 3.00 Beta1 Sitracker Support Incident Tracker 3.00 Sitracker Support Incident Tracker 21.8.00 Sitracker Support Incident Tracker 2.8.00 Sitracker Support Incident Tracker 18.8.00 Sitracker Support Incident Tracker 17.8.00 Sitracker Support Incident Tracker 16.8.00 Sitracker Support Incident Tracker 14.8.00 Sitracker Support Incident Tracker 11.8.00 Sitracker Support Incident Tracker 10.8.00 Sitracker Support Incident Tracker 1.8.00
Not Vulnerable:

Support Incident Tracker CVE-2012-2235 Cross-Site Scripting Vulnerability

Support Incident Tracker is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in Support Incident Tracker (SiT!) 3.65 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to index.php, which is not properly handled in an error message.

Support Incident Tracker CVE-2012-2235 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Support Incident Tracker CVE-2012-2235 Cross-Site Scripting Vulnerability

References:

• https://www.trustwave.com/spiderlabs/advisories/TWSL2012-012.txt (MISC)