CVE		CVE-2009-2733
Статус		UNKNOWN
Описание		Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4) atksearchmode[contracttype], and possibly (5) atksearch[contractname] parameters to the Organization Contracts administration page, reachable through dispatch.php.
Важность		Medium
CVSS score		4,3
CVSS vector		(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Phase		ASSIGNED (16.10.2009)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2733
References		BID : 36661
		BUGTRAQ : 20091013 [BONSAI] XSS in Achievo - Customized XSS payload included
		CONFIRM : http://www.achievo.org/download/releasenotes/1_4_0
		MISC : http://www.bonsai-sec.com/blog/index.php/cross-sit...
		MISC : http://www.bonsai-sec.com/research/vulnerabilities...
		SECTRACK : 1023017
		SECUNIA : 37035
		XF : achievo-dispatchphp-xss(53745)
		XF : achievo-title-xss(53744)
SecurityVulns:		Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)