CVE-2021-45811

MediumCVSS 6.5

Published: 08/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.45%

82th percentile - higher than 82% of all known CVEs

Summary

A SQL injection vulnerability in the Search functionality of tickets.php page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the combination of 'keywords' and 'topic_id' URL parameters.

Risk Assessment

An attacker can gain unauthorized access to the database, steal sensitive data (e.g., customer data, passwords) or modify system content.

Recommendation

Immediately update osTicket to the latest version that includes a fix for the SQL injection vulnerability.

Original NVD description (English source)

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.