Nessus Plugin #13645

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

osTicket Attachment Code Execution Vulnerability

Family:

CGI abuses

Category:

attack

Copyright:

This script is Copyright (C) 2004 George A. Theall

Summary:

Checks for Attachment Code Execution Vulnerability in osTicket

Version:

$Revision: 1.3 $

Cve_id:

CAN-2004-0613

Bugtraq_id:

10586

Xrefs:

-

Description:

The target is running at least one instance of osTicket that enables a
remote user to open a new ticket with an attachment containing arbitrary
PHP code and then to run that code using the permissions of the web
server user.

Solution : Apply FileTypes patch or upgrade to osTicket STS 1.2.7 or later.
Risk factor : High