CVE-2017-15580 osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as....
CriticalCVSS 9.8
EPSS 15.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| osticket | = 1.10.1 | No fix listed |
References
- 0day.today third-party-advisory
- nakedsecurity.com third-party-advisory
- becomepentester.blogspot.com exploit third-party-advisory
- cxsecurity.com exploit third-party-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- www.cyber-security.ro broken-link
- 45169 exploit third-party-advisory vdb-entry