This host is running ActivDesk and is prone to multiple cross site scripting and SQL injection vulnerabilities.

Successful exploitation allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Impact Level: Application

Upgrade to ActivDesk version 3.0.1 or later, For updates refer to http://www.webhelpdesk-software.com/download.html

Multiple flaws are due to - Improper validation of user-supplied input passed to the 'keywords0', 'keywords1', 'keywords2' and 'keywords3' parameters in search.cgi, which allows attackers to execute arbitrary HTML and script code on the web server. - Improper validation of user-supplied input passed to the 'cid' parameter in kbcat.cgi and the 'kid' parameter in kb.cgi, which allows attacker to manipulate SQL queries by injecting arbitrary SQL code.

ActivDesk version 3.0 and prior.

• http://itsecuritysolutions.org/2011-06-24-ActivDesk-3.0-multiple-security-vulnerabilities/
• http://secunia.com/advisories/45057/
• http://www.exploit-db.com/exploits/17443/

---

Updated on 2015-03-25