Summary
This host is installed with osTicket Ticketing System and is prone to multiple cross-site scripting vulnerabilities.
Impact
Successful exploitation will allow remote attacker to execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
Impact Level: Application
Solution
Upgrade to osTicket version 1.9.2 or later. For updates refer to http://osticket.com
Insight
Multiple flaws exist as input passed via 'Phone Number' POST parameter to the 'open.php' script, 'Phone Number','passwd1', 'passwd2' POST parameters to 'account.php' script, and 'do' parameter to 'account.php' script is not validated before returning it to users.
Affected
osTicket before version 1.9.2
Detection
Send a crafted HTTP POST request and check whether it is able to read cookie or not.
References
Severity
Classification
-
CVE CVE-2014-4744 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities