|
Description
|
|
High-Tech Bridge SA has discovered multiple vulnerabilities in HESK, which can be exploited by malicious people to conduct cross-site scripting attacks.
1) Input passed to the "hesk_settings[tmp_title]" and "hesklang[ENCODING]" parameters in /inc/header.inc.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Successful exploitation of this vulnerability requires that "register_globals" is enabled.
2) Input passed via the URL to language/en/test.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are confirmed in version 2.2. Other versions may also be affected.
|
