CVE-2017-14396

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php...

Sql injection

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php...

CVE-2017-14396

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php...

CVE-2017-14396

CVE-2017-14396 affects osTicket prior to 1.10.1. The vulnerability is an unauthenticated SQL injection in file handling, achieved by constructing an array via square brackets at the end of a parameter name (demonstrated with the key parameter to file.php). The underlying issue is improper handlin...

osTicket 1.10 - SQL Injection (PoC)

ADVISORY INFORMATION ======================================== Title: osTicket v1.10 Unauthenticated SQL Injection Application: osTicket Bugs: SQL Injection Class: Sensitive Information disclosure Remotely Exploitable: Yes Authentication Required: NO Versions Affected: = v1.10 Technology: PHP...

osTicket 1.10 SQL Injection

ADVISORY INFORMATION ======================================== Title: osTicket v1.10 Unauthenticated SQL Injection Application: osTicket Bugs: SQL Injection Class: Sensitive Information disclosure Remotely Exploitable: Yes Authentication Required: NO Versions Affected: = v1.10 Technology: PHP...

osTicket 1.10 - SQL Injection (PoC)

osTicket 1.10 - SQL Injection PoC 1. ADVISORY INFORMATION ======================================== Title: osTicket v1.10 Unauthenticated SQL Injection Application: osTicket Bugs: SQL Injection Class: Sensitive Information disclosure Remotely Exploitable: Yes Authentication Required: NO Versions...

vmail.geolives.com XSS vulnerability

Vulnerable URL: http://vmail.geolives.com/osticket/osTicket-1.8/file.php?key=xgybdv4t6t8j9eswlvnxfgsa9uxkjirm=1501804800=b2beec7f18008629cb8bbd1f7b3f0f61ea0c5402 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

osTicket 1.9.12 Cross Site Scripting

------------------------------------------------------------------------ Multiple persistent Cross-Site Scripting vulnerabilities in osTicket ------------------------------------------------------------------------ Han Sahin, July 2016...

Cross-site scripting vulnerability in wordpress plugin osticket-wp-bridge

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin osticket-wp-bridge suffers from a cross-site scripting vulnerability due to improper filtering of user...

Osticket 1.9.14 Cross Site Scripting

Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket is a widely-used open source support ticket system. It...

Osticket 1.9.14 - X-Forwarded-For Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket i...

osTicket 1.9.14 - X-Forwarded-For Cross-Site Scripting

osTicket 1.9.14 - X-Forwarded-For Cross-Site Scripting Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket ...

osTicket 1.9.14 - 'X-Forwarded-For' Cross-Site Scripting

Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket is a widely-used open source support ticket system. It...

Enhancesoft osTicket Session Fixation Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. A session fixation vulnerability exists in Enhancesoft osTicket. An attacker can vulnerability hijack a session to perform unauthorized access...

Enhancesoft osTicket Unauthorized Access Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. An unauthorized access vulnerability exists in Enhancesoft osTicket. An attacker can bypass the authentication mechanism and gain unauthorized access...

Enhancesoft osTicket HTML Injection Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. An HTML injection vulnerability exists in Enhancesoft osTicket, which can be exploited by attackers to execute arbitrary HTML or JavaScript code in t...

Enhancesoft osTicket Arbitrary File Upload Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. An arbitrary file upload vulnerability exists in Enhancesoft osTicket. An attacker can exploit the vulnerability to upload and execute arbitrary...

osticket.com XSS vulnerability

Vulnerable URL: http://www.osticket.com/mw/thumb.php?f=x%23%3Cbody%09onmousemove=confirm%28%27XSSPOSED%27%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 41877 Google Pagerank...

osTicket Cross-Site Scripting Vulnerability

osTicket is a WEB-based ticket e-commerce system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.9.5.1, which allows remote attackers to inject arbitrary web script or HTML via the lang parameter...