CVE-2008-0605

Multiple cross-site scripting (XSS) vulnerabilities in AstroSoft HelpDesk before 1.95.228 allow remote attackers to inject arbitrary web script or HTML via the (1) txtSearch parameter to operator/article/article_search_results.asp and the (2) Attach_Id parameter to operator/article/article_attachment.asp. NOTE: for vector 2, the XSS occurs in a forced SQL error message.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.49% chance of exploitation in the next 30 days, 72th percentile

Published

2008-02-06

Updated

2024-08-07

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/31104
• https://www.exploit-db.com/exploits/31103

References

• CVE Record
• NVD entry

Related

• CVE-2008-0603
• CVE-2008-0606
• CVE-2008-0602
• CVE-2008-0607
• CVE-2008-0601
• CVE-2008-0609