CVE-2010-4634

osTicket 1.6 - Path Traversal via File Parameter to module.php

Title source: llm

Description

Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party

References (5)

Core 5

Core References

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.org/1011-exploits/osticket-lfi.txt

Exploit mailing-list x_refsource_mlist

http://www.attrition.org/pipermail/vim/2010-November/002468.html

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/44739

Third Party Advisory mailing-list x_refsource_mlist

http://www.attrition.org/pipermail/vim/2010-November/002469.html

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/15471

Scores

EPSS 0.0248

EPSS Percentile 82.6%

Details

CWE

CWE-22

Status published

Products (1)

osticket/osticket 1.6

Published Dec 30, 2010

Tracked Since Feb 18, 2026