vendor:
Liberum Help Desk
by:
Cold z3ro
7.5
CVSS
HIGH
SQL Injection and Database Disclosure
89, 200
CWE
Product Name: Liberum Help Desk
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Liberum Help Desk (SQL/DD) Multiple Remote Vulnerabilities
The vulnerability exists due to insufficient sanitization of user-supplied input in the 'uid' parameter of the 'forgotpass.asp' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary SQL commands in the application's database. Also, the application discloses the database file 'helpdesk2000.mdb' which contains sensitive information.
Mitigation:
Input validation should be used to prevent SQL injection attacks. Also, the database file should not be accessible from the web.
