CVE-2005-3893
Last modified
CVE-2005-3893 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.. EPSS estimates a 7.17% chance of exploitation in the next 30 days.
Description
Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Otrs | Otrs | 1.0.0 |
| Otrs | Otrs | 1.3.2 |
| Otrs | Otrs | 2.0.0 |
| Otrs | Otrs | 2.0.1 |
| Otrs | Otrs | 2.0.2 |
| Otrs | Otrs | 2.0.3 |
References
- http://moritz-naumann.com/adv/0007/otrsmulti/0007.txtExploit, Patch, Vendor Advisory
- http://otrs.org/advisory/OSA-2005-01-en/Patch, Vendor Advisory
- http://secunia.com/advisories/17685/Patch, Vendor Advisory
- http://www.securityfocus.com/bid/15537/Exploit, Patch
- http://moritz-naumann.com/adv/0007/otrsmulti/0007.txtExploit, Patch, Vendor Advisory
- http://otrs.org/advisory/OSA-2005-01-en/Patch, Vendor Advisory
- http://secunia.com/advisories/17685/Patch, Vendor Advisory
- http://www.securityfocus.com/bid/15537/Exploit, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2005-3893?
How severe is CVE-2005-3893?
How do I fix CVE-2005-3893?
Are you affected by CVE-2005-3893?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST