CVE-2021-45811

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
VendorProductVersion
enhancesoftosticket
1.15 ≤
𝑥
≤ 1.15.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://enhancesoft.com
http://osticket.com
https://members.backbox.org/osticket-sql-injection/
http://enhancesoft.com
http://osticket.com
https://members.backbox.org/osticket-sql-injection/