CVE-2010-2912

high

Published 2010-07-28 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.5

Description

SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL commands via the _a parameter in a downloads action.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-14404 webapps php text · 1 KB

ScOrPiOn · 2010-07-18

Kayako eSupport 3.70.02 - 'functions.php' SQL Injection

text exploit Source: Exploit-DB

Peace !!

###########################################################################
Name : Kayako eSupport v3.70.02 SQL Injection Vulnerability
Date :  july 18,2010
Vendor urL : http://www.kayako.com/solutions/esupport/
Dork :Find It !!
Author : ScOrPiOn
Greetz : Dr.Dmar & Joker_1 & HiDDen HaCkEr & GeNeRaL KbKb & And All My Friends
###########################################################################
Effect :
/includes/functions.php
###########################################################################
Here The SQL Injec .....
http://server/Kayako/index.php?_m=downloads&_a=*SQLi*
###########################################################################

Peace !!

EDB-14392 webapps php verified text · 1 KB

Sid3^effects · 2010-07-17

Kayako eSupport 3.70.02 - SQL Injection

text exploit Source: Exploit-DB

Name :Kayako eSupport v3.70.02 SQL Injection Vulnerability
Date : july 17,2010
Critical Level 	: HIGH
vendor URL :http://www.kayako.com/solutions/esupport/
google dork:Help Desk Software by Kayako SupportSuite v3.70.02 
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller 
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
eSupport incorporates Kayako's leading ticket and e-mail management support desk software, including knowledgebase, troubleshooter, news and downloads publishing tools.
#######################################################################################################
Xploit:SQli Vulnerability

http://[site]/supportsuite/index.php?_m=news&_a=viewnews&newsid=[Sqli]
#######################################################################################################
# 0day no more 
# Sid3^effects

Application impact

Vendor	Product	Versions	Fixed
kayako	esupport	`3.70.02`

References

CWEs

CWE-89

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.