Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to contact_support.php; (2) contractid parameter to contract_add_service.php; (3) user parameter to edit_backup_users.php; (4) id parameter to edit_escalation_path.php; the Referer to (5) forgotpwd.php, (6) an approvalpage action to billable_incidents.php, or (7) transactions.php; (8) action parameter to inbox.php; (9) search_string parameter in a findcontact action to incident_add.php; table1 parameter to (10) report_customers.php, (11) report_incidents_by_engineer.php, (12) report_incidents_by_site.php, or (13) report_marketing.php; or the (14) startdate or (15) enddate parameter to report_incidents_by_vendor.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sitracker | Support Incident Tracker | <= 3.64 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/46019Vendor Advisory
- http://sitracker.org/wiki/ReleaseNotes365
- http://www.securityfocus.com/archive/1/519636Exploit
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incidenExploit
- http://secunia.com/advisories/46019Vendor Advisory
- http://sitracker.org/wiki/ReleaseNotes365
- http://www.securityfocus.com/archive/1/519636Exploit
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incidenExploit
FAQ
What is CVE-2011-5073?
CVE-2011-5073 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to conta...
How severe is CVE-2011-5073?
CVE-2011-5073 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-5073?
Check the references section above for vendor advisories and patch information. Affected products include: Sitracker Support Incident Tracker.