Test ID:	1.3.6.1.4.1.25623.1.0.902062
Category:	Web application abuses
Title:	DataTrack System <= 3.5 Multiple Vulnerabilities
Summary:	DataTrack System is prone to multiple vulnerabilities.
Description:	Summary: DataTrack System is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - An input passed via the 'Work_Order_Summary' parameter to 'Home.aspx' in the 'DataTrack Web Client' is not properly sanitised before being displayed to the user. - An improper validation of user supplied input, which can be exploited to disclose the contents of the 'root' directory, read arbitrary files, via a trailing backslash in a 'URL'. Vulnerability Impact: Successful exploitation will allow remote attackers to insert arbitrary HTML code in a user's browser session in the context of an affected site and to obtain sensitive information. Affected Software/OS: DataTrack System version 3.5 (3.5.8019.4) and probably prior. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-2043 BugTraq ID: 40249 http://www.securityfocus.com/bid/40249 http://cross-site-scripting.blogspot.com/2010/05/datatrack-system-35-persistent-xss.html http://packetstormsecurity.org/1005-exploits/datatrackserver35-xss.txt http://osvdb.org/64727 http://secunia.com/advisories/39868 XForce ISS Database: datatrack-workordersummary-xss(58732) https://exchange.xforce.ibmcloud.com/vulnerabilities/58732 Common Vulnerability Exposure (CVE) ID: CVE-2010-2078 XForce ISS Database: datatrack-unicode-info-disc(58734) https://exchange.xforce.ibmcloud.com/vulnerabilities/58734 Common Vulnerability Exposure (CVE) ID: CVE-2010-2079 XForce ISS Database: datatrack-backslash-info-disc(58735) https://exchange.xforce.ibmcloud.com/vulnerabilities/58735
Copyright	Copyright (C) 2010 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.