peter bassill · operator
$ cve CVE-2005-3893 JSON

CVE-2005-3893 EXPLOIT

7.5
HIGH · CVSS 2.0 · EPSS 7.2% (pctl 94)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.

Scoring

CVSS7.5 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS7.17% — more likely to be exploited than 94% of all CVEs
On CISA KEVno
Public exploityes
Published2005-11-29
Last modified2026-06-16

Affected (1)

VendorProduct
otrsotrs

Public exploits

SourceTitleDate
exploit-dbOTRS 2.0 - Login Function 'User' SQL Injection2005-11-22
exploit-dbOTRS 2.0 - AgentTicketPlain Action Multiple SQL Injections2005-11-22

References

→ the Explorer  ·  watch your stack  ·  NVD