Test ID:	1.3.6.1.4.1.25623.1.0.803935
Category:	Web application abuses
Title:	OTRS 1.0.0 - 1.3.2, 2.0.0 - 2.0.3 Multiple Input Validation Vulnerabilities
Summary:	OTRS (Open Ticket Request System) is prone to multiple input; validation vulnerabilities.
Description:	Summary: OTRS (Open Ticket Request System) is prone to multiple input validation vulnerabilities. Vulnerability Insight: Multiple errors exist in the application which fails to validate below user-supplied input's properly: - For XSS attack (1) QueueID parameter and (2) Action parameters (3) AttachmentDownloadType. - For SQL attack (1) user parameter (2) TicketID and (3) ArticleID parameters Vulnerability Impact: Successful exploitation will allow remote attackers to steal the victim's cookie-based authentication credentials or execute arbitrary SQL commands and bypass authentication. Affected Software/OS: OTRS (Open Ticket Request System) version 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3. Solution: Update to version 1.3.3, 2.0.4 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2005-3893 BugTraq ID: 15537 http://www.securityfocus.com/bid/15537/ Bugtraq: 20051122 OTRS 1.x/2.x Multiple Security Issues (Google Search) http://marc.info/?l=bugtraq&m=113272360804853&w=2 Debian Security Information: DSA-973 (Google Search) http://www.debian.org/security/2006/dsa-973 http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/039001.html http://moritz-naumann.com/adv/0007/otrsmulti/0007.txt http://www.osvdb.org/21064 http://www.osvdb.org/21065 http://securitytracker.com/id?1015262 http://secunia.com/advisories/17685/ http://secunia.com/advisories/18101 http://secunia.com/advisories/18887 SuSE Security Announcement: SUSE-SR:2005:030 (Google Search) http://www.novell.com/linux/security/advisories/2005_30_sr.html http://www.vupen.com/english/advisories/2005/2535 XForce ISS Database: otrs-agentticketplain-sql-injection(23354) https://exchange.xforce.ibmcloud.com/vulnerabilities/23354 XForce ISS Database: otrs-login-sql-injection(23352) https://exchange.xforce.ibmcloud.com/vulnerabilities/23352 Common Vulnerability Exposure (CVE) ID: CVE-2005-3894 http://www.osvdb.org/21067 XForce ISS Database: otrs-index-xss(23359) https://exchange.xforce.ibmcloud.com/vulnerabilities/23359 XForce ISS Database: otrs-queue-selection-xss(23356) https://exchange.xforce.ibmcloud.com/vulnerabilities/23356 Common Vulnerability Exposure (CVE) ID: CVE-2005-3895 http://www.osvdb.org/21066 http://securityreason.com/securityalert/200 XForce ISS Database: otrs-email-attachment-xss(23355) https://exchange.xforce.ibmcloud.com/vulnerabilities/23355
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.