Tickets CAD 2.20G is vulnerable to multiple vulnerabilities including Reflective/Stored XSS, information disclosure and CSRF. While logged in even with the default guest/guest credentials, the guest user is able to store and execute arbitrary JavaScript code withing the
application. Information disclosure also exist, the application does not properly check which user is currently logged in. Finally CSRF is also possible within the Tickets CAD application which allows an attacker to successfully add an admin account.
[+] A Reflective XSS vulnerability exist in the search function, search.php within the application
'><script>alert('XSS')</script>
[+] A Stored XSS vulnerability exist in log.php while creating a new log entry
'><script>alert('XSS')</script>
[+] Both of these vulnerabilities can be prevented by using strip_tags:
Disclosure Timeline:
# Jun 30 2012 - Contacted vendor
# Jul 23 2012 - Email to Dev team ask for an update and when next release will be issued
# Aug 04 2012 - Dev team became unresponsive Public Disclosure
