SQL Injection Vulnerability in osTicket Affecting Unauthorized Access
CVE-2021-42235

9.8CRITICAL

Key Information:

Vendor

Enhancesoft

Status
Osticket
Vendor
CVE Published:
4 May 2022

What is CVE-2021-42235?

An SQL injection vulnerability in osTicket versions prior to 1.14.8 and 1.15.4 allows attackers to exploit the login and password reset processes. This can lead to unauthorized access to sensitive administrative functionalities, potentially compromising the security of the entire osTicket instance. The vulnerability enables attackers to manipulate database queries, bypassing normal authentication mechanisms.

References

https://github.com/osTicket/osTicket/commit/e28291022e662...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.