CVE-2010-2912: Kayako eSupport allows remote attacker to run database commands

The index.php page in Kayako eSupport version 3.70.02 can be tricked into running unexpected database queries when an attacker supplies specially crafted input in the _a parameter of a downloads request. This could let an attacker view, change, or delete data stored by the help‑desk system. Apply the vendor’s security update or patch the affected file to validate and sanitize all input.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• http://packetstormsecurity.org/1007-exploits/kayakoesupport-sql.txt Exploit
• http://www.exploit-db.com/exploits/14404 Exploit
• http://www.securityfocus.com/bid/41756 Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60457