OSVDB ID: 21064

Title: OTRS (Open Ticket Request System) Login Function User Parameter SQL Injection

Info

Disclosure
Nov 22, 2005

Discovery
Oct 17, 2005

Dates

Exploit
Unknown

Solution
Unknown

Description

 OTRS contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the login function not properly sanitizing user-supplied input to the 'user' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

Classification

 Location: Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

 Upgrade to version 2.0.4 or higher or 1.3.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

OTRS Team

OTRS

 1.3.2
1.0.0
2.0.0
2.0.1
2.0.2
2.0.3

References

Credit
  • Moritz Naumann - securitymoritz-naumann.com - Moritz Naumann IT Consulting & Services


Direct URL: http://osvdb.org/21064