osTicket vulnerabilities

A session fixation vulnerability has been identified in osTicket v1.18.2, allowing an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) active after a successful login.

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing with low-entropy inputs like timestamp and client IP. This allows an attacker to brute-force the key within a feasible time window.

In osTicket versions prior to 1.17.8 and 1.18.4, a logic flaw in password reset token validation causes the expiry check to be performed only when the timestamp lookup fails, allowing reuse of a valid token.

A vulnerability in osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 allows a remote attacker to read arbitrary files from the server via ticket PDF export. The attacker can submit a ticket containing crafted rich-text HTML with PHP filter expressions that are insufficiently sanitized before being processed by the mPDF PDF generator. When the ticket is exported to PDF, the generated file can embed contents of attacker-selected files from the server filesystem as bitmap images, leading to disclosure of sensitive local files in the context of the osTicket application user.

SSRF vulnerability in osTicket before version 1.14.3 allows an attacker to add a malicious file to the server or perform port scanning.

In osTicket before version 1.10.7 and versions 1.12.x before 1.12.1, a stored XSS vulnerability was discovered in setup/install.php. Lack of input sanitization in the firstname and lastname fields allows injection of malicious queries that are then executed.

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1 where CSV formula injection exists in the export spreadsheets functionality. Spreadsheets are generated dynamically from unvalidated user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows agents to download data in .csv or .xls format that may contain malicious formulas.

In osTicket before version 1.12, an XSS vulnerability exists via uploading a crafted CSV file to the User Importer. File contents can appear in an error message, allowing script execution in the browser. This can lead to local file inclusion.

osTicket version 1.10.1 allows uploading 'html' files but does not properly validate the contents of the uploaded files, enabling the upload of arbitrary file types, including malicious ones. An attacker can exploit this vulnerability to upload malicious files to the web application.

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.

SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5. Remote attackers can execute arbitrary SQL commands via the staff username parameter.

A stored XSS vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. An unauthenticated attacker can send a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.

A Broken Object Level Authorization (BOLA) vulnerability in osTicket versions 1.18.3 and 1.17.7 leads to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem. An attacker can gain unauthorized access to other users' tickets.

A stored XSS vulnerability in osTicket versions 1.10 to 1.17.7 and 1.18.0 to 1.18.3, caused by a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allows remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.

osTicket up to version 1.18.3 has a Cross-Site Request Forgery (CSRF) vulnerability in the file include/class.dispatcher.php within the Dispatcher component. Manipulation of the _method argument leads to CSRF. Remote exploitation is possible, and the exploit has been publicly disclosed. The project was informed but has not reacted.

A user enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered on the platform.

A SQL injection vulnerability in the search functionality of the tickets.php page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the combination of 'keywords' and 'topic_id' URL parameters.

A SQL injection vulnerability in the Search functionality of tickets.php page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the combination of 'keywords' and 'topic_id' URL parameters.

An XSS vulnerability in osTicket before version 1.14.3 allows an attacker to inject malicious script via a crafted filename uploaded to the _uploadInlineImage() function in include/ajax.draft.php.

An XSS vulnerability in osTicket before version 1.14.3 exists due to missing input validation in include/staff/banrule.inc.php, where the echo statement outputs $info['notes'] without sanitization. An attacker can inject malicious JavaScript code that executes in other users' browsers.

In osTicket before version 1.10.7 and 1.12.x before 1.12.1, a vulnerability was found in the ticket creation form. Users can upload files, but content checks are insufficient and the server response is not handled properly, leading to persistent XSS. An attacker can upload an .html file, and the Content-Disposition header is set to inline instead of attachment, enabling cookie theft or other malicious actions.

A cross-site scripting (XSS) vulnerability was found in osTicket before version 1.10.2 in the /scp/index.php script. An attacker can inject arbitrary JavaScript or HTML code via the "sort" parameter.

A vulnerability in Enhancesoft osTicket before version 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated email address is known) by leveraging guest access and guessing a 6-digit number.

An integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting.

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter.

Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5. Remote attackers can inject arbitrary web script or HTML via the status parameter in a search action.

Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the Phone Number field in open.php or the passwd1, passwd2 fields and do parameter in account.php.

A directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a '..' sequence in the file parameter to module.php, a different vector than CVE-2005-1439. This issue has been disputed by a reliable third party.

Cross-site scripting (XSS) vulnerability in scp/ajax.php of osTicket before version 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.

SQL injection vulnerability in scp/ajax.php of osTicket before version 1.6.0 Stable. Allows remote authenticated users with Staff permissions to execute arbitrary SQL commands via the input parameter.

PHP remote file inclusion vulnerability in open_form.php of osTicket allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.

A directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. sequences in the file parameter.

Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via the t, osticket_title, em, e, err parameters and the name and subject fields when adding a ticket.