Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the $addy variable in email_parser.php, (3) $address variable in email_parser.php, (4) $a_address variable in structs.php, (5) kbid parameter to cer_KnowledgebaseHandler.class.php, (6) queues[] parameter to addresses_export.php, (7) $thread variable to display.php, (8) ticket parameter to display_ticket_thread.php.

The remote host is running Cerberus Helpdesk, a web-based helpdesk suite written in PHP. 

The installed version of Cerberus Helpdesk is affected by several SQL injection issues and one cross-site scripting flaw because of its failure to sanitize user-supplied input to various parameters and scripts before using it in database queries and in dynamically- generated HTML.  Successful exploitation of these issues requires that an attacker first authenticate.

The remote host is running Cerberus Support Center, a customer support portal written in PHP. 

The installed version of Cerberus Support Center is affected by a cross-site scripting flaw due to its failure to sanitize input to the 'kb_ask' parameter of the 'index.php' script before using it in dynamically-generated web pages.  In addition, it reportedly fails to sanitize input to the 'file_id' parameter of the 'attachment_send.php' script before using it in database queries. 

Exploitation of the SQL injection vulnerability requires that an attacker first authenticate while the cross-site scripting issue may be possible without authentication, depending on the application's configuration.

The remote host is running Cerberus, a web-based Help Desk.  This version of Cerberus is vulnerable to multiple flaws.  The more serious of these flaws involves SQL Injection.  An attacker can send a malformed request that, when parsed, will execute arbitrary commands on the remote database server.

ID	Name	Product	Family	Severity
20348	Cerberus Helpdesk GUI Agent < 2.7.1 Multiple Remote Vulnerabilities (SQLi, XSS)	Nessus	CGI abuses	high
20347	Cerberus Support Center Multiple Remote Vulnerabilities (SQLi, XSS)	Nessus	CGI abuses	high
3337	Cerberus Help Desk < 2.7.0 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-4427

critical

Tenable Plugins

high

high

high