----------------------------------------------------------------------

Want to work within IT-Security?

Secunia is expanding its team of highly skilled security experts.
We will help with relocation and obtaining a work permit.

Currently the following type of positions are available:
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Call Center Software Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA22365

VERIFY ADVISORY:
http://secunia.com/advisories/22365/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting, Manipulation of data, Exposure of sensitive
information

WHERE:
>From local network

SOFTWARE:
Call Center Software 0.x
http://secunia.com/product/12280/

DESCRIPTION:
Mayhemic Labs has discovered some vulnerabilities in
Call-Center-Software, which can be exploited by malicious users to
conduct script insertion attacks, disclose sensitive information, and
perform certain actions with escalated privileges, and by malicious
people to conduct SQL injection attacks.

1) Input passed to multiple parameters when adding or editing a call
is not properly sanitised before being used. This can be exploited to
insert arbitrary HTML and script code, which will be executed in
another user's or administrator's browser session in context of an
affected site.

2) Input passed to the "username" and "password" form field
parameters is not properly sanitised before being used in a SQL
query. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

Successful exploitation may grant access to the management section,
but requires that "magic_quotes_gpc" is disabled.

3) An error exists in the authentication process of edit_user.php.
This can be exploited to disclose and manipulate other user's
settings (e.g. disclose or change the password).

The vulnerabilities have been confirmed in version 0.93. Other
versions may also be affected.

SOLUTION:
Grant only trusted users access to the application.

PROVIDED AND/OR DISCOVERED BY:
Mayhemic Labs

ORIGINAL ADVISORY:
http://www.mayhemiclabs.com/advisories/MHL-2006-002.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------