CVE-2022-31890

Deeper analysis

CVE-2022-31890 is a SQL injection vulnerability (CWE-89) in the audit/class.audit.php file of osTicket osTicket-plugins prior to commit a7842d494889fd5533d13deb3c6a7789768795ae. The flaw exists in the getOrder function, which processes an order parameter without adequate sanitization, allowing malicious input to alter SQL queries. It carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted input to the order parameter and execute arbitrary SQL commands against the underlying database. Successful exploitation can result in data exfiltration, modification of records, or disruption of the osTicket application, effectively granting the attacker control equivalent to a database administrator in the affected deployment.

Public references include a Checkmarx analysis of osTicket vulnerabilities and the osTicket-plugins repository commit 0b59afbd2d4ccd0522552198a9aaf1ec05b5071e, which addresses the issue. Administrators should apply the referenced commit or a subsequent release that incorporates the fix to eliminate the vulnerable code path.

The associated EPSS score remains near 0.14 with negligible movement between current and peak values, indicating limited observed exploitation interest to date.