CVE-2010-0605

EPSS 3.0%

SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.org/1002-exploits/osTicket-1.6-RC5-SQLi.pdfunverified cve_referencewww.exploit-db.com/exploits/11380unverified exploitdbwww.exploit-db.com/exploits/11380unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osticket.com/forums/project.php?issueid=176 http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-SQLi.pdf http://secunia.com/advisories/38515 http://www.exploit-db.com/exploits/11380 http://www.securityfocus.com/bid/38166