Vulners
Lucene search
osTicket 1.14.2 - SSRF
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | Server-Side Request Forgery (SSRF) in osticket/osticket | 19 Sep 202117:30 | – | huntr |
 | CVE-2020-24881 | 31 May 202104:06 | – | circl |
 | osTicket Server-Side Request Forgery Vulnerability | 2 Nov 202000:00 | – | cnvd |
 | CVE-2020-24881 | 2 Nov 202014:42 | – | cve |
 | CVE-2020-24881 | 2 Nov 202014:42 | – | cvelist |
 | OsTicket < 1.14.3 - Server Side Request Forgery | 7 Jun 202603:02 | – | nuclei |
 | CVE-2020-24881 | 2 Nov 202021:15 | – | nvd |
 | osTicket < 1.14.3 Multiple Vulnerabilities | 31 Aug 202000:00 | – | openvas |
 | CVE-2020-24881 | 2 Nov 202021:15 | – | osv |
 | osTicket 1.14.2 Server-Side Request Forgery | 19 Jan 202100:00 | – | packetstorm |
10
# Exploit Title: osTicket 1.14.2 - SSRF
# Date: 18-01-2021
# Exploit Author: Talat Mehmood
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Version: <1.14.3
# Tested on: Linux
# CVE : CVE-2020-24881
osTicket before 1.14.3 suffers from Server Side Request Forgery [SSRF]. HTML page is rendered on backend server on calling "Print" ticket functionality.
Below are the steps to reproduce this vulnerability:
1. Create a new ticket
2. Select "HTML Format" format.
3. Add an image tag with your payload in src attribute i.e. "<img src=https://mymaliciouswebsite.com">
4. After submitting this comment, print this ticket.
5. You'll receive a hit on your malicious website from the internal server on which osTicket is deployed.
For more details, read my following blog:
https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0
https://nvd.nist.gov/vuln/detail/CVE-2020-24881Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
19 Jan 2021 00:00Current
9.6High risk
Vulners AI Score9.6
CVSS 27.5
CVSS 3.19.8
EPSS0.91343