osTicket
Footprinting/Discovery/Enumeration
OSTSESSID cookie
Vulnerabilities
osTicket version 1.14.1 suffers from CVE-2020-24881 which was an SSRF vulnerability.
If we come across a customer support portal during our assessment and can submit a new ticket, we may be able to obtain a valid company email address.
If the company set up their helpdesk software to correlate ticket numbers with emails, then any email sent to the email we received when registering, 940288@inlanefreight.local, would show up here. With this setup, if we can find an external portal such as a Wiki, chat service (Slack, Mattermost, Rocket.chat), or a Git repository such as GitLab or Bitbucket, we may be able to use this email to register an account and the help desk support portal to receive a sign-up confirmation email.
Last updated