File Upload Vulnerability in osTicket Affects User Data Security
CVE-2019-14748
Key Information:
Badges
What is CVE-2019-14748?
An identified vulnerability in osTicket prior to version 1.10.7 and in the 1.12.x series before 1.12.1 allows attackers to exploit insufficient mitigations in the file upload functionality. Users can upload files, such as .html documents, which are processed without adequate content checks. This oversight not only facilitates persistent XSS attacks but also jeopardizes user security by permitting cookie theft and other malicious actions. The Content-Disposition header is erroneously set to inline for uploads, further exacerbating the risk of exploitation.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.