Title: Cerberus Helpdesk Multiple Input Validation Vulnerabilities
Severity: HIGH
Description:
Cerberus Helpdesk is an email management application written in PHP.
Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that will be included in site output or in SQL queries.
A cross-site scripting vulnerability exists in the 'index.php' script and may be exposed through the 'kb_ask' parameter. An attacker could exploit the issue by enticing a user to follow a malicious link that included hostile HTML and script code as an argument to the variable.
An SQL injection vulnerability exists in the 'file_id' variable of the 'attachment_send.php' script.
SQL injection vulnerabilities exist in the 'addy' and 'address' variables of the 'email_parser.php' script. These issues exist in the 'is_queue_address()', 'is_banned_address()', and 'is_admin_address()' functions of this script.
An SQL injection vulnerability exists in the 'cer_email_address_struct()' function in the 'structs.php' script.
An SQL injection vulnerability exists in the '_load_article_details()' function of the 'cer_KnowledgebaseHandler.class.php' script.
An SQL injection vulnerability exists in the 'queues' variable of the 'addresses_export.php' script.
An SQL injection vulnerability exists in the 'thread' variable of the 'display.php' script.
An SQL injection vulnerability exists in the 'ticket' variable of the 'display_ticket_thread.php' script.
The cross-site scripting vulnerability may permit a remote attacker to steal cookie-based authentication credentials from legitimate users. Successful exploitation of SQL injection vulnerabilities could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Affected Products:
- Cerberus Helpdesk cerberus-gui 2.649.0
- Cerberus Helpdesk support-center 2.649.0
References:
- Cerberus: HelpDesk Product Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
