Call-Center-Software is 'a free open-source application released under the GPL". Call-Center-Software is vulnerable to multiple SQL injection attacks and XSS under certain conditions, along with privilege escalation.
XSS:
Call-Center-Software does not escape data when handling it allowing malicious javascript data to be inserted by any user. This is only when Magic Quotes is disabled within PHP.
Example:
A user entering <script>alert("Moo!");</script> into the problem description field when submitting the problem, will cause the javascript to be executed upon viewing or editing the problem.
SQL Injection:
Call-Center-Software does not escape data when handling it allowing malicious users to inject SQL commands into the database. This is only when Magic Quotes is disabled within PHP.
Example:
By logging into the system with the user "'or 1=1 or 1='" the attacker is let into the system with full administrative privileges.
Privilege Escalation and Password Disclosure:
Call-Center-Software does not check access privileges when bringing up the "edit user" screen. This, also combined with the lack of hashed password, discloses any user on the system's password, username, and other information stored within the database.
Example:
When logged in as a non administrative user a user can go to edit_user.php?user_id=1 and view the default admin account's password. Changing the user_id variable discloses the corresponding account's data.
Workaround:
Enabling Magic Quotes will negate the XSS and SQL injection attacks on affected systems.
