Detections
Analytics
Kayako SupportSuite 3.x <= 3.70.02 Multiple Vulnerabilities
medium Nessus Plugin ID 57976
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple vulnerabilities.Description
The remote host contains a version of Kayako SupportSuite 3.x that is equal to or earlier than 3.70.02 and is, therefore, affected by multiple vulnerabilities :- Numerous cross-site scripting issues exist in the script 'staff/index.php' and in the 'LiveSupport' module. (PT-2011-01, PT-2011-04)
- An input validation error exists in the administrative template editing interface that could allow a malicious user to cause arbitrary PHP code to be executed.
(PT-2011-02)
- An input validation error exists in the script 'staff/index.php' that can allow an attacker to determine the install path of the application.
(PT-2011-03)
Solution
Upgrade to Kayako Fusion 4.0 or later. The vendor has not yet released a patch for 3.x.See Also
http://en.securitylab.ru/lab/PT-2011-01
http://en.securitylab.ru/lab/PT-2011-02
Plugin Details
Severity: Medium
ID: 57976
File Name: kayako_3_multiple_vulns.nasl
Version: 1.7
Type: remote
Family: CGI abuses
Published: 2/16/2012
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.4
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:kayako:supportsuite
Required KB Items: www/PHP, www/kayako_supportsuite
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/25/2011
Vulnerability Publication Date: 12/29/2011
Reference Information
BID: 51377