Description

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.

Remediation

References

CVE-2017-15580

Related Vulnerabilities

WordPress Plugin WordPress+Microsoft Office 365/Azure AD-LOGIN Unspecified Vulnerability (11.6)

Jboss EAP Improper Input Validation Vulnerability (CVE-2019-12400)

WordPress Plugin RegistrationMagic-User Registration with Custom Registration Forms Cross-Site Scripting (5.3.2.0)

Oracle Database Server CVE-2010-0911 Vulnerability (CVE-2010-0911)

osCommerce Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2018-18573)

Severity

Critical

Classification

CVE-2017-15580 CWE-434 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities