Test ID:	1.3.6.1.4.1.25623.1.0.902530
Category:	Web application abuses
Title:	ActivDesk < 3.0.1 Multiple Vulnerabilities - Active Check
Summary:	ActivDesk is prone to multiple cross-site scripting (XSS) and; SQL injection (SQLi) vulnerabilities.
Description:	Summary: ActivDesk is prone to multiple cross-site scripting (XSS) and SQL injection (SQLi) vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - Improper validation of user-supplied input passed to the 'keywords0', 'keywords1', 'keywords2' and 'keywords3' parameters in search.cgi, which allows attackers to execute arbitrary HTML and script code on the web server. - Improper validation of user-supplied input passed to the 'cid' parameter in kbcat.cgi and the 'kid' parameter in kb.cgi, which allows attacker to manipulate SQL queries by injecting arbitrary SQL code. Vulnerability Impact: Successful exploitation allows an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Affected Software/OS: ActivDesk version 3.0 and prior. Solution: Update to version 3.0.1 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1563 BugTraq ID: 46937 http://www.securityfocus.com/bid/46937 http://www.exploit-db.com/exploits/17025 http://aluigi.org/adv/realwin_2-adv.txt http://aluigi.org/adv/realwin_3-adv.txt http://aluigi.org/adv/realwin_4-adv.txt http://aluigi.org/adv/realwin_5-adv.txt http://aluigi.org/adv/realwin_7-adv.txt http://aluigi.org/adv/realwin_8-adv.txt http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-080-04.pdf http://secunia.com/advisories/43848 http://securityreason.com/securityalert/8176 http://www.vupen.com/english/advisories/2011/0742 Common Vulnerability Exposure (CVE) ID: CVE-2011-1564 http://aluigi.org/adv/realwin_6-adv.txt http://securityreason.com/securityalert/8177
Copyright	Copyright (C) 2011 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.