Security Advisory
CVE-2017-15580
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
osTicket 1.10.1 provides a functionality to upload html files with associated formats. However, it does not properly validate the uploaded files contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.