osTicket <= 1.2.7 Multiple Vulnerabilities

The version of osTicket installed on the remote host suffers from several vulnerabilities : - A Remote File Include Vulnerability The script 'include/main.php' lets an attacker read arbitrary files on the remote host and possibly even run arbitrary PHP code, subject to the privileges of the web...

CVE-2005-1436

CVE-2005-1436 corresponds to osTicket XSS vulnerabilities across multiple input vectors. Connected sources indicate broader issues in osTicket versions &lt;= 1.2.7 and

CVE-2005-1437

CVE-2005-1437 pertains to osTicket and is confirmed by multiple sources as a SQL injection vulnerability. The consistent detail across documents is that remote attackers could execute arbitrary SQL commands through the (1) id parameter to admin.php or (2) cat parameter to view.php, enabling unaut...

CVE-2005-1439

CVE-2005-1439 : In osTicket, a directory traversal vulnerability exists in attachments.php that allows remote attackers to read arbitrary files via .. sequences in the file parameter. Evidence from multiple sources confirms a network-wide, unauthenticated remote attack vector with a base CVSS v2 ...

CVE-2005-1437

Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to admin.php or 2 cat parameter to view.php...

CVE-2005-1438

PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the includedir parameter...

CVE-2005-1439

Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter...

CVE-2005-1436

Multiple cross-site scripting XSS vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via 1 the t parameter to view.php, 2 the ostickettitle parameter to header.php, 3 the em parameter to adminlogin.php, 4 the e parameter to userlogin.php, 5 the err parameter...

CVE-2005-1438

PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the includedir parameter...

CVE-2005-1437

Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to admin.php or 2 cat parameter to view.php...

CVE-2005-1439

Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter...

CVE-2005-1436

Multiple cross-site scripting XSS vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via 1 the t parameter to view.php, 2 the ostickettitle parameter to header.php, 3 the em parameter to adminlogin.php, 4 the e parameter to userlogin.php, 5 the err parameter...

CVE-2005-1438

The connected documents confirm a Remote File Include vulnerability in osTicket variants, specifically CVE-2005-1438, via the include_dir parameter in main.php. The issue affects osTicket versions up to 1.2.7 (per Tenable NASL “osTicket &lt;= 1.2.7 Multiple Vulnerabilities”) and is included among...

PT-2005-2435 · Osticket · Osticket

Name of the Vulnerable Software and Affected Versions: osTicket affected versions not specified Description: A directory traversal issue exists in the attachments.php file of osTicket, allowing remote attackers to read arbitrary files by using .. sequences in the file parameter of the...

CVE-2005-1438: Undefined Security Weakness

PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the includedir parameter...

CVE-2005-1439: Undefined Security Weakness

Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter...

CVE-2005-1437: Undefined Security Weakness

Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to admin.php or 2 cat parameter to view.php...

CVE-2005-1436: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via 1 the t parameter to view.php, 2 the ostickettitle parameter to header.php, 3 the em parameter to adminlogin.php, 4 the e parameter to userlogin.php, 5 the err parameter...

CVE-2004-0613

osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory...

CVE-2004-0614

osTicket trusts a hidden form field in the submit form to limit the upload size of a document, which could allow remote attackers to upload a file of any size...