CVE-2005-3893

Published: Nov 29, 2005Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.

Affected (6)

Products: Otrs: Otrs

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Otrs Otrs	Version 1.0.0
Otrs Otrs	Version 1.3.2
Otrs Otrs	Version 2.0.0
Otrs Otrs	Version 2.0.1
Otrs Otrs	Version 2.0.2
Otrs Otrs	Version 2.0.3

References (32)

http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/039001.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=113272360804853&w=2

Source: cve@mitre.org

http://moritz-naumann.com/adv/0007/otrsmulti/0007.txt

Source: cve@mitre.org

ExploitPatchVendor Advisory

http://otrs.org/advisory/OSA-2005-01-en/

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/17685/

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18101

Source: cve@mitre.org

http://secunia.com/advisories/18887

Source: cve@mitre.org

http://securitytracker.com/id?1015262

Source: cve@mitre.org

http://www.debian.org/security/2006/dsa-973

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2005_30_sr.html

Source: cve@mitre.org

http://www.osvdb.org/21064

Source: cve@mitre.org

http://www.osvdb.org/21065

Source: cve@mitre.org

http://www.securityfocus.com/bid/15537/

Source: cve@mitre.org

ExploitPatch

http://www.vupen.com/english/advisories/2005/2535

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/23352

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/23354

Source: cve@mitre.org

http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/039001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=113272360804853&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://moritz-naumann.com/adv/0007/otrsmulti/0007.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

http://otrs.org/advisory/OSA-2005-01-en/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/17685/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/18101

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/18887

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1015262

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2006/dsa-973

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.novell.com/linux/security/advisories/2005_30_sr.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/21064

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/21065

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/15537/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.vupen.com/english/advisories/2005/2535

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/23352

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/23354

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.