CVE-2019-14750
MediumCVSS 6.1Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
In osTicket before version 1.10.7 and versions 1.12.x before 1.12.1, a stored XSS vulnerability was discovered in setup/install.php. Lack of input sanitization in the firstname and lastname fields allows injection of malicious queries that are then executed.
Risk Assessment
An attacker can exploit this vulnerability to steal user session cookies or perform other malicious actions, compromising the confidentiality and integrity of organizational data.
Recommendation
Immediately update osTicket to version 1.10.7 or 1.12.1, which include fixes addressing the lack of input sanitization.
Original NVD description (English source)
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.