CVE-2017-15580

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

15.56% chance of exploitation in the next 30 days, 97th percentile

Published

2017-10-23

Updated

2024-08-05

Proof-of-concept exploits (2)

• https://cxsecurity.com/issue/WLB-2017100187
• https://packetstormsecurity.com/files/144747/osticket1101-shell.txt

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/45169

References

• CVE Record
• NVD entry

Related

• CVE-2017-15579
• CVE-2017-15595
• CVE-2017-15578
• CVE-2017-15600
• CVE-2017-15565
• CVE-2017-15601