CVE-2021-45811

2023-09-0800:00:00

mitre

www.cve.org

sql injection

osticket

search functionality

authenticated attackers

arbitrary sql commands

url parameters

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.4%

JSON

A SQL injection vulnerability in the “Search” functionality of “tickets.php” page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the “keywords” and “topic_id” URL parameters combination.

References

enhancesoft.com

osticket.com

members.backbox.org/osticket-sql-injection/