PT-2017-13439 · Osticket · Osticket

Published 2017-09-12 · Updated 2017-09-21 · CVE-2017-14396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.1

Description The issue allows for SQL injection by constructing an array via the use of square brackets at the end of a parameter name. This is demonstrated by the key parameter to "file.php".

Recommendations For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-14396

Affected Products

Osticket

References · 5

• 🔥 https://exploit-db.com/exploits/42660 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14396 · Security Note
• http://osticket.com/blog/125 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14396 · Note