CVE-2017-14396

In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-09-12

Last modified

2024-08-05

Weaknesses

CWE-89

Affected products

• Osticket (Osticket)

References

• http://www.osticket.com/blog/125