CVE-2009-2361

High

Published: 08/07/2009(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.17%

91th percentile - higher than 91% of all known CVEs

Summary

SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5. Remote attackers can execute arbitrary SQL commands via the staff username parameter.

Risk Assessment

Risk of unauthorized database access, sensitive data leakage, and potential system takeover.

Recommendation

Immediately upgrade osTicket to version 1.6 RC5 or later and implement parameterized SQL queries.

Original NVD description (English source)

SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter.