From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 4 Jul 2006 14:13:05 +0200
Subject: [NEWS] Kyberna AG ky2help Multiple SQL Injections
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060705061050.4AF3E59D0@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Kyberna AG ky2help Multiple SQL Injections
------------------------------------------------------------------------
SUMMARY
"Kyberna ky2help is a commercial solution for a web-based ticketing and
support system"
Improper handling of user input allows attackers to execute XSS attacks
using Kyberna AG ky2help.
DETAILS
Authenticated users may be able to exploit this vulnerability by accessing
the "Meine Links" (engl. "My Links") and using the single hyphen as input.
So no further exploit is required for a simple proof-of-concept.
It is important to state that only authenticated and legitimate users are
able to launch the attack. The login screen and the provided user fields
in that screen are not affected, the reason is that just authenticated and
legitimate users are able to access vulnerable parts of the solution, the
impact is not on the highest level.
Workaround:
Companies running ky2help in high security environments are requested to
restrict the access to vulnerable systems. Only trusted users should be
able to login in such environments.
Vendor Status:
Kyberna AG has been informed on an early stage on 11/01/2005 via email to
info-at-kyberna.com
Kyberna AG released a fixed version of the software
Disclosure Timeline:
10/27/05 Identification of the flaw
11/01/05 Reporting the flaw to Kyberna AG via email
04/07/06 Public advisory
ADDITIONAL INFORMATION
The information has been provided by <mailto:maru@scip.ch.> Marc Ruef.
The original article can be found at:
<http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2351>;
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2351
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
