vendor:
FRticket
by:
Hamit ABİŞ
8,8
CVSS
HIGH
Stored XSS
79
CWE
Product Name: FRticket
Affected Version From: v1
Affected Version To: v1
Patch Exists: NO
Related CWE: N/A
CPE: a:codecanyon:frticket:1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2016
FRticket – Ticket System – Stored XSS
FRticket is a customer support ticket system. An attacker can inject malicious code into the ticket title field, which is stored in the database and can be executed when the ticket is viewed by an administrator. This can be exploited to execute arbitrary HTML and JavaScript code in the browser of the administrator.
Mitigation:
Input validation should be used to prevent malicious code from being stored in the database.
