Unrated severityOSV Advisory· Published Apr 25, 2019· Updated Aug 4, 2024

CVE-2019-11537

Description

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Osticket/OsticketOSV2 versions
v1.10, v1.10-rc.3, v1.10.1, …+ 1 more
- (no CPE)range: v1.10, v1.10-rc.3, v1.10.1, …
- (no CPE)range: <1.12

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/46753/mitreexploitx_refsource_EXPLOIT-DB
github.com/osTicket/osTicket/pull/4869mitrex_refsource_MISC
github.com/osTicket/osTicket/releases/tag/v1.12mitrex_refsource_MISC
pentest.com.tr/exploits/osTicket-v1-11-XSS-to-LFI.htmlmitrex_refsource_MISC
www.exploit-db.com/exploits/46753mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.004
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000