CVE-2009-2361

SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter.

• CWE-89

• http://osticket.com/forums/project.php?issueid=118Vendor Advisory
• http://secunia.com/advisories/35629Vendor Advisory
• http://www.exploit-db.com/exploits/9032
• http://www.ngenuity.org/wordpress/2009/06/26/osticket-admin-login-blind-sql-injection/Exploit
• http://www.osvdb.org/55472
• http://www.securityfocus.com/archive/1/504615/100/0/threaded
• http://www.securityfocus.com/bid/35516
• http://www.securitytracker.com/id?1022480
• http://www.vupen.com/english/advisories/2009/1726Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51417
• http://osticket.com/forums/project.php?issueid=118Vendor Advisory
• http://secunia.com/advisories/35629Vendor Advisory
• http://www.exploit-db.com/exploits/9032
• http://www.ngenuity.org/wordpress/2009/06/26/osticket-admin-login-blind-sql-injection/Exploit
• http://www.osvdb.org/55472
• http://www.securityfocus.com/archive/1/504615/100/0/threaded
• http://www.securityfocus.com/bid/35516
• http://www.securitytracker.com/id?1022480
• http://www.vupen.com/english/advisories/2009/1726Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51417

Published

Jul 8, 2009

Last Modified

Jul 10, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2355The forum module in NullLogic Groupware 1.2.7 allows remote …
• CVE-2009-2356Multiple stack-based buffer overflows in the pgsqlQuery func…
• CVE-2009-2357The default configuration of TekRADIUS 3.0 uses the sa accou…
• CVE-2009-2358TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRA…
• CVE-2009-2359Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allo…
• CVE-2009-2360Cross-site scripting (XSS) vulnerability in passwd/main.php …
• CVE-2009-2362Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 …
• CVE-2009-2363Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 a…
• CVE-2009-2364Stack-based buffer overflow in Mp3-Nator 2.0 allows remote a…
• CVE-2009-2365SQL injection vulnerability in login.asp in DataCheck Soluti…
• CVE-2009-2366SQL injection vulnerability in login.asp in DataCheck Soluti…
• CVE-2009-2367cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predi…9.8