CVE-2019-14750
published 2019-08-07CVE-2019-14750: An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization…
PriorityP346medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
11.69%
95.5th percentile
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| osticket | osticket | < 1.10.7 | 1.10.7 |
| osticket | osticket | >= 1.12 < 1.12.1 | 1.12.1 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
osTicket 1.12 - Persistent Cross-Site Scripting
exploitdb·2019-08-12·CVSS 6.1
CVE-2019-14750 [MEDIUM] osTicket 1.12 - Persistent Cross-Site Scripting
osTicket 1.12 - Persistent Cross-Site Scripting
---
# Exploit Title: osTicket-v1.12 Stored XSS
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14750
1. Description
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
Stored XSS exists in setup/install.php. It was observed that no input
sanitization was provided in the firstname and lastname fields of the
application. The insertion of malicious queries in those fields leads to
the execution of those queries. This can further lead to cookie stealing or
other malicious actions.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2
Nuclei
osTicket < 1.12.1 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2019-14750 [MEDIUM] osTicket < 1.12.1 - Cross-Site Scripting
osTicket '
- 'getConfig().resolve'
condition: and
- type: word
part: header_4
words:
- text/html
- type: status
status:
- 200
extractors:
- type: regex
name: csrftoken
part: body
group: 1
regex:
- '__CSRFToken__" value="(.*?)"'
internal: true
# digest: 4a0a00473045022100e792125d6eaed9a992d1730e636e2ff917b13794791825a71ae0b84efb17b6ca02205eba35d5a3734546d5367b45e5f9d88f6ab953889f51471a8819949b717ad52c:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.htmlhttps://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12https://github.com/osTicket/osTicket/releases/tag/v1.10.7https://github.com/osTicket/osTicket/releases/tag/v1.12.1https://www.exploit-db.com/exploits/47226http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.htmlhttps://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12https://github.com/osTicket/osTicket/releases/tag/v1.10.7https://github.com/osTicket/osTicket/releases/tag/v1.12.1https://www.exploit-db.com/exploits/47226
2019-08-07
Published