vendor:
osTicket
by:
SecurityFocus
7,5
CVSS
HIGH
Multiple Cross-Site Scripting, Open-Redirection, Multiple SQL-Injection
79,601,89,564,89,564,89,564
CWE
Product Name: osTicket
Affected Version From: 1.7 DPR3
Affected Version To: 1.7 DPR3
Patch Exists: YES
Related CWE: N/A
CPE: osticket
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2013
osTicket Multiple Input-Validation Vulnerabilities
osTicket is prone to multiple input-validation vulnerabilities including multiple cross-site scripting vulnerabilities, an open-redirection vulnerability, and multiple SQL-injection vulnerabilities. An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
Mitigation:
Ensure that input is properly sanitized and validated before being used in the application.
