Kristian Varnai

A DOM-based cross-site scripting issue was found in a legacy utility of the software, which can be exploited for cross-site scripting (XSS) attacks.

The system is affected by remote and local file inclusion due to a lack of restrictions on targeted files. This can lead to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).

The issue allows remote logging to be accessed by unauthenticated users, enabling an attacker to hijack system logs. This can include sensitive data such as user names and HTTP data.

The issue allows authenticated code execution. Authenticated users with the right to create reports can utilize BIRT templates to execute code.

The issue allows remote attackers to write to arbitrary .ini files by using a crafted language.save task.

The issue allows remote attackers to inject arbitrary web script or HTML via vectors related to `name` and `message`.

The issue allows remote attackers to execute arbitrary SQL commands via the `ticket code` or `email` parameter. Additionally, remote authenticated users can execute arbitrary SQL commands via the `filter order` parameter.

The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability. This is achieved by using a .. (dot dot) in the `filename` parameter within a "ticket.download attachment" task.

The issue allows remote attackers to read the support tickets of arbitrary users by obtaining the target ticketId and navigating to the "http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}" endpoint.