CVE-2025-26241

MediumCVSS 6.5

Published: 05/05/2025(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A SQL injection vulnerability in the search functionality of the tickets.php page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the combination of 'keywords' and 'topic_id' URL parameters.

Risk Assessment

An attacker can gain unauthorized access to the database, steal sensitive data (e.g., customer data, passwords), or modify the ticket system content.

Recommendation

Immediately upgrade osTicket to a version later than 1.17.5 that includes a fix for the SQL injection vulnerability.

Original NVD description (English source)

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.