Multiple Input Validation Vulnerabilities in osTicket
osTicket is affected by multiple input validation vulnerabilities due to a failure in the application to properly sanitize user-supplied input. Reportedly the application permits the inclusion of remote code that could be run under the permissions of the affected Web server. The application is vulnerable to multiple cross-site scripting vulnerabilities, which could allow for theft of cookie-based authentication credentials. If the file upload feature is enabled then a directory traversal vulnerability is possible, which could be exploited to retrieve sensitive or privileged information normally accessible to the Web server. The application is also prone to HTML injection and multiple SQL injection vulnerabilities, which could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
