CVE-2019-14750

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

10.90%

Published

Aug 7, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

TrickestTrickest PoC index Exploit-DBosTicket 1.12 - Persistent Cross-Site Scripting NucleiNuclei detection template

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.

Weaknesses (CWE)

CWE-79

Affected Products (2)

osticket · osticket (up to 1.10.7)vulnerable

osticket · osticket (up to 1.12.1)vulnerable

References (10)

http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html

Third Party AdvisoryVDB Entry

https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12

PatchThird Party Advisory

https://github.com/osTicket/osTicket/releases/tag/v1.10.7

Release NotesThird Party Advisory