Description

SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter.

Remediation

References

CVE-2010-0605

Related Vulnerabilities

Artifactory Insufficient Verification of Data Authenticity Vulnerability (CVE-2018-19971)

Dotclear Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-1613)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2092)

LimeSurvey Incorrect Default Permissions Vulnerability (CVE-2019-16185)

WordPress Plugin Party Hall Booking Manager SQL Injection (1.1)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2010-0605