Support Incident Tracker (SiT!) is prone to the following input- validation vulnerabilities: 1. A cross-site scripting vulnerability 2. An SQL-injection vulnerability 3. A PHP code-injection vulnerability 4. A path-disclosure vulnerability 5. An arbitrary-file-upload vulnerability Exploiting these issues could allow an attacker to execute arbitrary code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Access to sensitive data may also be used to launch further attacks against a vulnerable computer. Support Incident Tracker (SiT!) 3.65 is vulnerable other versions may also be affected.

• http://secunia.com/secunia_research/2011-75/
• http://secunia.com/secunia_research/2011-76/
• http://secunia.com/secunia_research/2011-77/
• http://secunia.com/secunia_research/2011-78/
• http://secunia.com/secunia_research/2011-79/
• http://sitracker.sourceforge.net
• http://www.securityfocus.com/bid/50632

---

Updated on 2015-03-25