CVE Catalog
CVE-2017-14396
CriticalSummary
In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized database queries, potentially leading to the disclosure of sensitive data or system compromise.
Recommendation
It is recommended to upgrade osTicket to version 1.10.1 or later to mitigate this vulnerability.
Original NVD description (English source)
In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.