CVE-2008-0605

CVE-2008-0605 describes multiple cross-site scripting (XSS) vulnerabilities in AstroSoft HelpDesk versions prior to 1.95.228. Specifically, remote attackers can inject arbitrary web script or HTML through the "txtSearch" parameter in operator/article/article_search_results.asp and the "Attach_Id" parameter in operator/article/article_attachment.asp, with the latter occurring within a forced SQL error message. This vulnerability has a CVSS score of 4.3 (Medium severity), indicating a network-based attack with medium complexity and potential for partial integrity impact. The EPSS score is low, suggesting a low probability of exploitation. While not listed on the CISA KEV catalog or Hot List, exploit code for both XSS vectors is publicly available on ExploitDB. There is no evidence of active exploitation, and the vulnerability has received minimal community discussion or media coverage.