lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: 1 Jul 2005 11:49:52 -0000 From: ghc@....ru To: bugtraq@...urityfocus.com Subject: [SECURITY ALERT] osTicket bugs ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~ ~ RST / GHC -> OSTICKET <- ADVISORY ~ ~ Product: osTicket ~ ~ Version: <= 1.3.1 beta ~ ~ URL: http://www.osticket.com ~ ~ Risk: medium ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [Product Description] "osTicket is a widely-used open source support ticket system. Plain and simple it is a lightweight feature packed support ticket tool written mainly using PHP scripting language." [Summary] Insufficient filtration of user input data can lead to SQL injection vulnerability and arbitrary file including. [Details] -----------[SQL injection]---------- Vulnerable script: class.ticket.php Vulnerable code: --[code]-- function CloseTicket($ticket) { mysql_query("UPDATE tickets SET status = 'closed' WHERE ID=$ticket"); // - SQL injection } -[skip]- function ReopenTicket($ticket) { mysql_query("UPDATE tickets SET status='open' WHERE ID=$ticket"); // - SQL injection } -[skip]- function PostMessage($ticket, $message, $headers='', $notify=true) { global $config; $headers = $config[save_headers] ? $headers: ""; $gmtime = (time() - date("Z")) + 3600; ReopenTicket($ticket); mysql_query("INSERT INTO ticket_messages (ticket, message, headers, timestamp) VALUES($ticket, '" . addslashes(striptags($message)) . // - SQL injection "', '" . addslashes($headers) . "', FROM_UNIXTIME('$gmtime') + 0)"); if ($config[alert_new]) { email_alert($ticket, mysql_insert_id()); } $t = mysql_fetch_array(mysql_query ("SELECT email, cat FROM tickets WHERE ID=$ticket")); // - SQL injection --[/code]-- It is possible to inject arbitrary SQL code through POST query. An attacker can use one-char bruteforce technique to get some sensitive information from database. ----------[Arbitrary file including (local)]---------- $inc variable is not defined in files vew.php and open.php in some cases. If "Register Globals" is "on", an attacker can define this variable to invoke arbitrary local file inclusion. Vulnerable code: --[code]-- include(INCLUDE_DIR."/$inc.php"); --[/code]-- POC: http://vulnsite/osticket/view.php?inc=x Server answer: [23-Jun-2005 00:57:40] PHP Warning: main(): Failed opening '/home/vulnsite/public_html/_osticket/include/x.php' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in /home/vulnsite/public_html/_osticket/view.php on line 98 +---------------------------------------------+ | Discovered by edisan & foster | | http://www.ghc.ru http://rst.void.ru | +---------------------------------------------+
Powered by blists - more mailing lists