CVE-2023-51547

CVE-2023-51547 affects Fluent Support (WordPress plugin) up to version 1.7.6. It is an authenticated SQL Injection caused by improper neutralization of input in SQL commands. Impact per sources is high; patch status is Patched, but no fixed version is specified in the provided documents. Recommen...

CVE-2023-51547: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through...

CVE-2023-50070

Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customersupport/ajax.php?action=saveticket via departmentid, customerid, and subject...

CVE-2023-50070

Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customersupport/ajax.php?action=saveticket via departmentid, customerid, and subject...

PT-2023-31467

Name of the Vulnerable Software and Affected Versions Sourcecodester Customer Support System version 1.0 Description The issue concerns multiple SQL injection vulnerabilities in the /customer support/ajax.php?action=save ticket endpoint via department id, customer id, and subject. This allows for...

PT-2023-31430

Name of the Vulnerable Software and Affected Versions Customer Support System version v1 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the subject parameter at the "/customer support/ajax.php?action=save ticket" API endpoint...

PT-2023-31434

Name of the Vulnerable Software and Affected Versions Customer Support System version v1 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at "/customer support/index.php?page=new ticket...

Metasploit Weekly Wrap-Up: Dec. 15, 2023

Continuing the 12th Labor of Metasploit Metasploit continues its Herculean task of increasing our toolset to tame Kerberos by adding support for ASREP Roasting, which allows retrieving the password hashes of users who have Do not require Kerberos preauthentication set on the domain controller. Th...

Exploit for SQL Injection in Oretnom23 Customer_Support_System

CVE-2023-50070 Customer Support System 1.0 - Multiple SQL in...

Zammad Information Disclosure Vulnerability (CNVD-2023-9769727)

Zammad is a suite of ticket management software from the German company Zammad. Zammad suffers from an information disclosure vulnerability that stems from the use of the public endpoint /api/v1/signshow as its login screen, which returns internal configuration data for user object attributes. An...

CVE-2023-50457

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions...

Design/Logic Flaw

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions...

Internet Bug Bounty: curl HSTS long file name clears contents

When saving HSTS data using curl, a vulnerability was found where using an excessively long file name could result in the clearing of all contents. This caused subsequent requests using that file to be unaware of the HSTS status they should have used. The reason was that curl appended a suffix to...

CVE-2023-50457: Incorrect Authorization

An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticket, a user could see entries for which they lack permissions...

Kerberos Ticket Management

Manage kerberos tickets on a compromised host. Module Options msf use post/windows/manage/kerberostickets msf postkerberostickets show actions ...actions... msf postkerberostickets set ACTION msf postkerberostickets show options ...show and set options... msf postkerberostickets run This module...

inTouch 1.0 File Upload - Remote Code Execution Vulnerability

Title: inTouch-1.0 File Upload - RCE Author: nu11secur1ty Vendor: https://codecanyon.net/user/media-city Software: https://codecanyon.net/item/intouch-laravel-support-ticket-management-system/35177425?srank=2 Reference: https://portswigger.net/web-security/file-upload,...

OTRS Security Vulnerabilities

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS versions 8.0.X through 8.0.37. An attacker exploiting this vulnerability could read a plain text password sent back to the client in a server response...

CVE-2023-33706

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...

CVE-2023-33706

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...

CVE-2023-33706

SysAid before 23.2.15 allows Indirect Object Reference IDOR attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp...