bugtraq - Cerberus Helpdesk vulnerable to XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060130234255.8639.qmail@securityfocus.com>
Date: 30 Jan 2006 23:42:55 -0000
From: preben@...chcom.no
To: bugtraq@...urityfocus.com
Subject: Cerberus Helpdesk vulnerable to XSS


Inputs in the Cerberus Helpdesk is not properly sanitized, and XSS is possible in a lot of the systems input fields and url parameters.

You can add XSS that will hit every user of the system, and even simple scripting tags like <script>alert(‘f’)</script> is allowed

PoC: http://www.SITE.example/tts2/clients.php?mode=search&sid=<sidvalue>&contact_search=<script>alert('c')</script>

Vendor’s site:
http://www.webgroupmedia.com

Please credit to: Preben Nyløkken