CVE-2005-3893

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-11-29 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action, and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.

Affected products

OTRS AG OTRS: 1.0.0, 1.3.2, 2.0.0, 2.0.1, 2.0.2, 2.0.3

References

http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/039001.html
http://marc.info/?l=bugtraq&m=113272360804853&w=2
http://moritz-naumann.com/adv/0007/otrsmulti/0007.txt
http://otrs.org/advisory/OSA-2005-01-en/
http://secunia.com/advisories/17685/
http://secunia.com/advisories/18101
http://secunia.com/advisories/18887
http://securitytracker.com/id?1015262
http://www.debian.org/security/2006/dsa-973
http://www.novell.com/linux/security/advisories/2005_30_sr.html
http://www.osvdb.org/21064
http://www.osvdb.org/21065

Get alerted when CVE-2005-3893 or the next vulnerability affects your stack