ActivDesk Multiple Cross Site Scripting and SQL Injection Vulnerabilities

Summary
This host is running ActivDesk and is prone to multiple cross site scripting and SQL injection vulnerabilities.
Impact
Successful exploitation allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Impact Level: Application
Solution
Upgrade to ActivDesk version 3.0.1 or later, For updates refer to http://www.webhelpdesk-software.com/download.html
Insight
Multiple flaws are due to - Improper validation of user-supplied input passed to the 'keywords0', 'keywords1', 'keywords2' and 'keywords3' parameters in search.cgi, which allows attackers to execute arbitrary HTML and script code on the web server. - Improper validation of user-supplied input passed to the 'cid' parameter in kbcat.cgi and the 'kid' parameter in kb.cgi, which allows attacker to manipulate SQL queries by injecting arbitrary SQL code.
Affected
ActivDesk version 3.0 and prior.
References