##########################################################
# GulfTech Security Research December 18th, 2004
##########################################################
# Vendor : Kayako Web Solutions
# URL : http://www.kayako.com/
# Version : Kayako eSupport v2.x
# Risk : Multiple Vulnerabilities
##########################################################
Description:
Kayako eSupport is one of the most feature packed support systems; in this
tour you will find why over a thousand companies have decided to opt for
eSupport and use it to process their daily support requests. [As quoted
from their website]
Cross Site Scripting:
Cross site scripting exists in Kayako eSupport. This vulnerability exists
due to user supplied input not being checked properly. Below is an example.
http://path/index.php?_a=knowledgebase&_j=search&searchm=[CODEGOESHERE]
This vulnerability could be used to steal cookie based authentication
credentials within the scope of the current domain, or render hostile code
in a victim's browser.
SQL Injection:
Kayako eSupport is prone to SQL Injection in a number of places. Below are
some examples of url's that could be used to take advantage of these
vulnerabilities.
http://path/index.php?_a=knowledgebase&_j=subcat&_i=[SQL]
http://path/index.php?_a=knowledgebase&_j=rate&_i=[SQL]&type=no
http://path/index.php?_a=knowledgebase&_j=questiondetails&_i=[SQL]
http://path/index.php?_a=tickets&_m=viewmain&email22=blah@blah&ticketkey22=[
SQL]
http://path/index.php?_a=tickets&_m=viewmain&email22=[SQL]&ticketkey22=
These is also a SQL Injection vulnerability in the "Home > Ticket Status
Forgot Key" feature. This can be take advantage of by putting a malicious
query in the email field. Because of the location of the unchecked variable
in the query, it makes it easy for an attacker to use these issues to query
just about any info from the underlying database. It should also be noted
that
the attacker does not need to be logged in to eSupport
Solution:
The Kayako support team was informed of these vulnerabilities and they
should
be fixed soon.
Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00056-12182004
Credits:
James Bercegay of the GulfTech Security Research Team
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.296 / Virus Database: 265.6.0 - Release Date: 12/17/2004
