This host is running ActivDesk and is prone to multiple cross site scripting and SQL injection vulnerabilities.
Successful exploitation allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Impact Level: Application
Upgrade to ActivDesk version 3.0.1 or later, For updates refer to http://www.webhelpdesk-software.com/download.html
Multiple flaws are due to - Improper validation of user-supplied input passed to the 'keywords0', 'keywords1', 'keywords2' and 'keywords3' parameters in search.cgi, which allows attackers to execute arbitrary HTML and script code on the web server. - Improper validation of user-supplied input passed to the 'cid' parameter in kbcat.cgi and the 'kid' parameter in kb.cgi, which allows attacker to manipulate SQL queries by injecting arbitrary SQL code.
ActivDesk version 3.0 and prior.
- Ajax File and Image Manager 'data.php' PHP Code Injection Vulnerability
- Awstats Configuration File Remote Arbitrary Command Execution Vulnerability
- Advanced Guestbook Index.PHP SQL Injection Vulnerability
- ASP-Dev XM Event Diary Multiple Vulnerabilities
- Atutor AChecker Multiple SQL Injection and XSS Vulnerabilities