PT-2017-13439 · Osticket · Osticket

Publicado 2017-09-12 · Atualizado 2017-09-21 · CVE-2017-14396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.1

Description The issue allows for SQL injection by constructing an array via the use of square brackets at the end of a parameter name. This is demonstrated by the key parameter to "file.php".

Recommendations For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-14396

Produtos afetados

Osticket

Referências · 5

• 🔥 https://exploit-db.com/exploits/42660 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14396 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14396 · Nota de Segurança
• http://osticket.com/blog/125 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14396 · Nota