Login Request a demo
Critical severity · published Sep 17, 2016
CVE-2016-5843
Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to…
9.4
CVSS
3.2%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Faq · Otrs
2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +24 more · source: NVD
Affected product
FA
Faq
Otrs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5843
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5843
www.securityfocus.com
http://www.securityfocus.com/bid/93019
Issue Tracking
https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9
Issue Tracking
https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557
Issue Tracking
https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3
Vendor Advisory
https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/
More from Faq
6.5
CVE-2013-2625
An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8
6.1
CVE-2013-2637
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles,…
4.3
CVE-2021-21438
Agents are able to see linked FAQ articles without permissions (defined in FAQ Category)