CVE-2017-15580

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.

• CWE-434

• http://0day.today/exploits/28864Third Party Advisory
• http://nakedsecurity.com/cve/CVE-2017-15580/Third Party Advisory
• https://becomepentester.blogspot.com/2017/10/osTicket-File-Upload-Restrictions-Bypassed-CVE-2017-15580.htmlExploit, Third Party Advisory
• https://cxsecurity.com/issue/WLB-2017100187Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/144747/osticket1101-shell.txtExploit, Third Party Advisory, VDB Entry
• https://www.cyber-security.ro/blog/2017/10/25/osticket-1-10-1-shell-upload/Broken Link
• https://www.exploit-db.com/exploits/45169/Exploit, Third Party Advisory, VDB Entry
• http://0day.today/exploits/28864Third Party Advisory
• http://nakedsecurity.com/cve/CVE-2017-15580/Third Party Advisory
• https://becomepentester.blogspot.com/2017/10/osTicket-File-Upload-Restrictions-Bypassed-CVE-2017-15580.htmlExploit, Third Party Advisory
• https://cxsecurity.com/issue/WLB-2017100187Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/144747/osticket1101-shell.txtExploit, Third Party Advisory, VDB Entry
• https://www.cyber-security.ro/blog/2017/10/25/osticket-1-10-1-shell-upload/Broken Link
• https://www.exploit-db.com/exploits/45169/Exploit, Third Party Advisory, VDB Entry

Published

Oct 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15575In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm l…
• CVE-2017-15576Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time …
• CVE-2017-15577Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the r…
• CVE-2017-15578In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists vi…
• CVE-2017-15579In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists vi…
• CVE-2017-1558IBM Maximo Asset Management 7.5 and 7.6 could allow a remote…
• CVE-2017-15581In the "Diary with lock" (aka WriteDiary) application 4.72 f…
• CVE-2017-15582In net.MCrypt in the "Diary with lock" (aka WriteDiary) appl…
• CVE-2017-15583The embedded web server on ABB Fox515T 1.0 devices is vulner…
• CVE-2017-15587An integer overflow was discovered in pdf_read_new_xref_sect…
• CVE-2017-15588An issue was discovered in Xen through 4.9.x allowing x86 PV…
• CVE-2017-15589An issue was discovered in Xen through 4.9.x allowing x86 HV…