CVE-2019-14750

43Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 11%

probabilidad de explotación

11%top 5% de las CVE

explotación observada

noninguna fuente lo reporta

2 exploit(s) público(s)

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/47226 cve_referencepacketstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.htmlno verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12 https://github.com/osTicket/osTicket/releases/tag/v1.10.7 https://github.com/osTicket/osTicket/releases/tag/v1.12.1 https://www.exploit-db.com/exploits/47226