CVE-2007-5727 | BDVDB-2026-27499 Detail

Description#

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://osvdb.org/38836
http://www.securityfocus.com/archive/1/482790/100/0/threaded
http://secunia.com/advisories/27415
http://securityreason.com/securityalert/3320
http://www.securityfocus.com/bid/26208
http://osvdb.org/38215
http://www.securityfocus.com/bid/26217

Exploit#

No public exploit known

History#

Version 12007-10-30Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.