Kayako eSupport v3.70.02 SQL Injection Vulnerability

vendor:

eSupport

by:

ScOrPiOn

CVSS

HIGH

SQL Injection

CWE

Product Name: eSupport

Affected Version From: 3.70.02

Affected Version To: 3.70.02

Patch Exists: NO

Related CWE: N/A

CPE: a:kayako:esupport

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Kayako eSupport v3.70.02 SQL Injection Vulnerability

A SQL injection vulnerability exists in Kayako eSupport v3.70.02, which allows an attacker to execute arbitrary SQL commands via the _m and _a parameters in the index.php file.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Additionally, the application should use parameterized queries to prevent SQL injection.

Source

Exploit-DB raw data:

Peace !!

###########################################################################
Name : Kayako eSupport v3.70.02 SQL Injection Vulnerability
Date :  july 18,2010
Vendor urL : http://www.kayako.com/solutions/esupport/
Dork :Find It !!
Author : ScOrPiOn
Greetz : Dr.Dmar & Joker_1 & HiDDen HaCkEr & GeNeRaL KbKb & And All My Friends
###########################################################################
Effect :
/includes/functions.php
###########################################################################
Here The SQL Injec .....
http://server/Kayako/index.php?_m=downloads&_a=*SQLi*
###########################################################################

Peace !!