42 lines
No EOL
1.6 KiB
Text
42 lines
No EOL
1.6 KiB
Text
# Exploit Title: osTicket-v1.12 Stored XSS
|
|
# Vendor Homepage: https://osticket.com/
|
|
# Software Link: https://osticket.com/download/
|
|
# Exploit Author: Aishwarya Iyer
|
|
# Contact: https://twitter.com/aish_9524
|
|
# Website: https://about.me/aish_iyer
|
|
# Category: webapps
|
|
# CVE: CVE-2019-14750
|
|
|
|
1. Description
|
|
|
|
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
|
|
Stored XSS exists in setup/install.php. It was observed that no input
|
|
sanitization was provided in the firstname and lastname fields of the
|
|
application. The insertion of malicious queries in those fields leads to
|
|
the execution of those queries. This can further lead to cookie stealing or
|
|
other malicious actions.
|
|
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14750
|
|
|
|
2. Proof of Concept
|
|
|
|
Steps to Reproduce:
|
|
- While setting up the osTicket application in the setup/install.php page
|
|
insert the XSS payload into the first name and last name field.
|
|
- After filling in all the other details and clicking on 'continue', it is
|
|
observed that there is no validation for the first name and last name field
|
|
and the malicious payload is stored and a new agent is created.
|
|
- Login as that agent and navigate to "agents" tab where we will find the
|
|
inserted payload in the firstname and Lastname field.
|
|
- Click on the firstname value and see the payload gets executed
|
|
|
|
3. Reference
|
|
|
|
https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
|
|
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
|
|
https://github.com/osTicket/osTicket/releases/tag/v1.10.7
|
|
|
|
4. Solution
|
|
|
|
The vulnerability has been patched by the vendor in the next release which
|
|
is osTicket v1.10.7. |