CVE-2025-10692

HighCVSS 7.1

Published: 03/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

The endpoint POST /api/staff/get-new-tickets in OpenSupports 4.11.0 concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. An authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, bypass department scoping, and disclose tickets beyond their intended access.

Risk Assessment

A low-privileged staff user could access tickets from other departments, breaching data confidentiality. This may lead to leakage of sensitive customer information.

Recommendation

Update OpenSupports to a patched version or implement parameterized SQL queries in the affected endpoint. Verify that other endpoints are not also vulnerable to SQL injection.

Other vulnerabilities in OpenSupports

CVE-2025-10695Medium
OpenSupports 4.11.0 exposes two unauthenticated diagnostic endpoints with permission 'any', allowing arbitrary backend-initiated network connections to an attacker-supplied destination. This enables unauthenticated SSRF for internal network scanning and service interaction.

Original NVD description (English source)

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, effectively bypassing department scoping and disclosing tickets beyond their intended access.This issue affects OpenSupports: 4.11.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS