CVE-2011-5070 in Support Incident Tracker
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref, linkref, linktype parameters, which are not properly handled in the clean_int function in lib/base.inc.php, or the redirect parameter, which is not properly handled in the html_redirect function in lib/html.inc.php; and (3) unspecified vectors in translate.php.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/23/2025
The CVE-2011-5070 vulnerability represents a critical cross-site scripting flaw in Support Incident Tracker version 3.65, a web-based incident management system that has been widely deployed in enterprise environments. This vulnerability classifies under CWE-79 - Improper Neutralization of Input During Web Page Generation, which is a fundamental weakness in web application security that allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects multiple components within the SiT! application, creating a broad attack surface that could potentially compromise user sessions and access sensitive system information.
The technical exploitation of this vulnerability occurs through several attack vectors that all stem from inadequate input sanitization and validation within the application's core functions. The primary attack path involves the file name parameter in incident_attachments.php, where unfiltered user input can be directly embedded into web responses without proper encoding or validation. Additionally, the link_add.php component contains multiple vulnerable parameters including origref, linkref, linktype, and redirect that are processed through the clean_int function in lib/base.inc.php and the html_redirect function in lib/html.inc.php respectively. These functions fail to properly sanitize inputs, allowing attackers to inject malicious JavaScript code that executes in the context of other users' browsers when they view affected pages.
The operational impact of this vulnerability extends beyond simple script injection, as it creates potential for session hijacking, credential theft, and data exfiltration within compromised environments. Attackers could leverage these XSS flaws to establish persistent access to the incident tracking system, potentially gaining access to confidential support tickets, user information, and system configurations. The vulnerability's presence in core functions like html_redirect and clean_int suggests that the underlying sanitization mechanisms are fundamentally flawed, potentially affecting a wide range of application functionality. This type of vulnerability aligns with ATT&CK technique T1566.001 - Phishing, where attackers could craft malicious links that, when clicked by authenticated users, would execute malicious code in their browsers.
Mitigation strategies should focus on implementing comprehensive input validation and output encoding across all application components, with particular attention to the functions mentioned in the vulnerability description. The clean_int function in lib/base.inc.php and html_redirect function in lib/html.inc.php require immediate remediation through proper input sanitization using established encoding libraries such as html_entity_decode or similar mechanisms. Organizations should implement Content Security Policy headers to limit script execution and consider implementing web application firewalls to detect and block malicious payloads. Regular security assessments and input validation reviews should be conducted to prevent similar vulnerabilities from emerging in future releases, particularly focusing on the application's core utility functions that handle user-supplied data. The vulnerability also underscores the importance of following secure coding practices as outlined in OWASP Top Ten and NIST guidelines for preventing injection flaws in web applications.