CVE-2011-5073 in Support Incident Tracker
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to contact_support.php; (2) contractid parameter to contract_add_service.php; (3) user parameter to edit_backup_users.php; (4) id parameter to edit_escalation_path.php; the Referer to (5) forgotpwd.php, (6) an approvalpage action to billable_incidents.php, or (7) transactions.php; (8) action parameter to inbox.php; (9) search_string parameter in a findcontact action to incident_add.php; table1 parameter to (10) report_customers.php, (11) report_incidents_by_engineer.php, (12) report_incidents_by_site.php, or (13) report_marketing.php; or the (14) startdate or (15) enddate parameter to report_incidents_by_vendor.php.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/18/2025
The vulnerability described in CVE-2011-5073 represents a critical cross-site scripting flaw affecting Support Incident Tracker version 3.64 and earlier. This vulnerability stems from inadequate input validation and sanitization mechanisms within multiple PHP scripts that process user-supplied data without proper escaping or encoding. The affected application fails to properly handle malicious input across various parameter names and script endpoints, creating multiple attack vectors that could be exploited by remote attackers to execute arbitrary web scripts or HTML code within the context of a victim's browser session.
The technical implementation of this vulnerability manifests through several distinct code paths where user input flows directly into HTML output without appropriate sanitization measures. The affected parameters include mode, contractid, user, id, Referer, approvalpage, action, search_string, table1, startdate, and enddate across different PHP scripts including contact_support.php, contract_add_service.php, edit_backup_users.php, edit_escalation_path.php, forgotpwd.php, billable_incidents.php, transactions.php, inbox.php, incident_add.php, and various report generation scripts. These parameters are processed through unvalidated user input flows that bypass standard security controls designed to prevent malicious code injection.
From an operational perspective, this vulnerability enables attackers to perform session hijacking, defacement of web applications, credential theft, and potential privilege escalation within the application's context. The impact extends beyond simple XSS exploitation as attackers can leverage these vulnerabilities to create persistent backdoors, steal sensitive user information, or redirect victims to malicious sites. The widespread nature of affected scripts across different functional areas of the application increases the attack surface and potential damage. According to CWE standards, this vulnerability maps to CWE-79 which specifically addresses cross-site scripting flaws, while the ATT&CK framework would categorize this under T1566.001 - Phishing: Spearphishing Attachment and T1059.001 - Command and Scripting Interpreter: Visual Basic, representing the execution of malicious code through web-based attack vectors.
The exploitation of these vulnerabilities typically involves crafting malicious payloads containing JavaScript code or HTML tags that are then submitted through the vulnerable parameters. When legitimate users navigate to pages containing the malicious input, the injected code executes in their browser context, potentially leading to unauthorized actions, data exfiltration, or further compromise of the application environment. Organizations using SiT! version 3.64 or earlier should immediately implement mitigations including input validation, output encoding, and parameter sanitization across all affected scripts. The most effective remediation involves upgrading to version 3.65 or later where these vulnerabilities have been addressed through proper input validation and sanitization mechanisms. Additionally, implementing Content Security Policy headers, regular security audits, and web application firewalls can provide additional layers of protection against similar vulnerabilities in the future.