CVE-2019-14749

HIGH

osTicket <1.10.7, <1.12.1 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-14749. PoCs published by Aishwarya Iyer.

AI-analyzed exploit summary The exploit describes a CSV formula injection vulnerability in osTicket before 1.10.7 and 1.12.x before 1.12.1. It allows untrusted input in user fields to be exported as a spreadsheet, leading to remote code execution when opened in applications like Excel.

Description

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Aishwarya Iyer · textwebappsphp
https://www.exploit-db.com/exploits/47225

The exploit describes a CSV formula injection vulnerability in osTicket before 1.10.7 and 1.12.x before 1.12.1. It allows untrusted input in user fields to be exported as a spreadsheet, leading to remote code execution when opened in applications like Excel.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: osTicket < 1.10.7, osTicket 1.12.x < 1.12.1
Auth required
Prerequisites: Agent or user access to input fields · Victim to open exported spreadsheet
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/osTicket/osTicket/releases/tag/v1.10.7
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/47225

Scores

CVSS v3 8.8
EPSS 0.0961
EPSS Percentile 94.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-1236
Status published
Products (1)
osticket/osticket < 1.10.7
Published Aug 07, 2019
Tracked Since Feb 18, 2026