Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
osTicket Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2019-14750 - Vulnerability Database
osTicket

osTicket Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2019-14750

Medium
Reference: CVE-2019-14750
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-14750
Title: osTicket Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.