Stored Cross-Site Scripting Vulnerability in osTicket Plugins by osTicket
CVE-2022-32074
5.4MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2022-32074?
A stored cross-site scripting vulnerability exists within the audit/class.audit.php component of the osTicket-plugins, specifically in the Storage-FS interface. Attackers can exploit this vulnerability by uploading a crafted SVG file, which allows them to execute arbitrary web scripts or HTML within the application's context. This could lead to unauthorized actions and the potential compromise of user data, emphasizing the need for immediate remediation.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.