CVE-2010-0460 in SupportSuite
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in staff/index.php in Kayako SupportSuite 3.60.04 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) subject parameter and (2) contents parameter (aka body) in an insertquestion action. NOTE: some of these details are obtained from third party information.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/29/2026
The vulnerability identified as CVE-2010-0460 represents a critical cross-site scripting flaw within Kayako SupportSuite version 3.60.04 and earlier installations. This security weakness resides in the staff/index.php component of the application and affects authenticated users who can leverage this vulnerability to execute malicious code within the context of other users' browsers. The flaw manifests through two distinct input parameters that are processed during the insertquestion action, specifically the subject parameter and the contents parameter which serves as the body of the question. These parameters are not properly sanitized or validated, creating an avenue for attackers to inject arbitrary web script or HTML content that will be executed when other users view the affected content.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding practices within the Kayako SupportSuite application. When authenticated staff members submit questions through the insertquestion functionality, the application fails to properly escape or filter user-supplied data before storing and rendering it. This classic input validation failure allows attackers to craft malicious payloads that can execute in the browser context of other users who subsequently view the compromised content. The vulnerability operates under the Common Weakness Enumeration classification of CWE-79, which specifically addresses Cross-Site Scripting flaws that occur when untrusted data is sent to a web browser without proper sanitization. The attack vector requires authentication to the system, meaning that only users with valid credentials can exploit this vulnerability, though this limitation does not diminish its potential impact on the security posture of the organization.
The operational impact of this vulnerability extends beyond simple data theft or defacement, as it can enable more sophisticated attacks within the compromised environment. An attacker who successfully exploits this vulnerability can potentially establish persistent access to the application, harvest session cookies, or redirect users to malicious sites that can capture additional credentials or sensitive information. The presence of authenticated users makes this vulnerability particularly dangerous as it can be used to escalate privileges or access restricted areas of the application that might contain sensitive customer data or administrative functions. According to the MITRE ATT&CK framework, this vulnerability aligns with techniques related to command and control communications and credential access, as it provides a method for attackers to maintain persistence and potentially expand their access within the compromised environment. The attack can result in unauthorized data access, modification of support tickets, or complete compromise of the support suite functionality.
Mitigation strategies for CVE-2010-0460 should prioritize immediate remediation through the application of vendor patches or updates to Kayako SupportSuite versions that address these XSS vulnerabilities. Organizations should implement comprehensive input validation and output encoding mechanisms to prevent similar issues in other components of their web applications. The implementation of Content Security Policy headers can provide an additional layer of protection against XSS attacks by restricting the sources from which scripts can be loaded and executed. Security teams should also consider implementing web application firewalls that can detect and block malicious payloads attempting to exploit XSS vulnerabilities. Regular security assessments and code reviews should be conducted to identify and remediate similar input validation weaknesses throughout the application stack. Additionally, user education regarding the risks of clicking on suspicious links or content within support applications can help reduce the likelihood of successful exploitation, though this approach should not be relied upon as the primary defense mechanism.