CVE-2009-4433

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.24%

Published

Dec 28, 2009

Modified

Apr 22, 2026

Public PoC / Exploit (4)

All weaponized →

Exploit-DBiSupport 1.8 - 'index.php?which' Cross-Site Scripting Exploit-DBiSupport 1.8 - 'ticket_function.php' Multiple Cross-Site Scripting Vulnerabilities Exploit-DBiSupport 1.8 - Cross-Site Scripting / Local File Inclusion TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (a) 5 or (b) 9 field in a post action to ticket_function.php, reachable through ticket_submit.php and index.php; (c) the which parameter to function.php, or (d) the which parameter to index.php, related to knowledgebase_list.php. NOTE: some of these details are obtained from third party information.

Weaknesses (CWE)

CWE-79

Affected Products (3)

idevspot · isupportvulnerable

References (18)

http://packetstormsecurity.org/0912-exploits/isupport-lfixss.txt

Exploit

http://secunia.com/advisories/37726

Vendor Advisory

http://www.exploit-db.com/exploits/10478

Exploit

http://www.osvdb.org/61109