CVE-2020-12629

This exploit demonstrates a persistent authenticated XSS vulnerability in osTicket 1.14.1. The vulnerability allows an attacker to inject malicious JavaScript via the 'name' parameter in the SLA plan, which executes when viewed by other users, potentially stealing cookie information.

This PoC demonstrates a persistent authenticated XSS vulnerability in osTicket 1.14.1 via the 'name' parameter in the SLA plan update request. The exploit injects malicious JavaScript into the SLA name field, which executes when viewed by an authenticated user.