SQL Injection Vulnerability in osTicket 1.15.x
CVE-2021-45811

6.5MEDIUM

Key Information:

Vendor

Enhancesoft

Status
Osticket
Vendor
CVE Published:
8 September 2023

What is CVE-2021-45811?

A SQL injection vulnerability exists in the 'Search' function of the 'tickets.php' page in osTicket versions 1.15.x, enabling authenticated attackers to exploit vulnerable query parameters. By manipulating the 'keywords' and 'topic_id' parameters, attackers can execute arbitrary SQL commands, compromising the integrity and confidentiality of the database.

References

http://osticket.com
http://enhancesoft.com
https://members.backbox.org/osticket-sql-injection/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.