Is osTicket safe to use?

kikloo

Hi.

I have installed osTicket and it seems to be running fine ..anyways recently I got emails which says:

Excessive login attempts by a client

Email: ../../../../../../etc/passwd

Ticket#: \"\'>#(1234567890*27)#

IP: 165.193.42.137

Time 1, 2009, 5 am CST

Attempts #4

What is this ? It seems someone is trying to hack into the system ? :

Any help is appericiated on this issue.

Thanks.

4ice

100% safe programs do not exist in my opinion :)

This email is being sent if you have checked the box "System Errors: Excessive Login attempts". So it's a built-in security method, I am only not sure after how many times this happens.

So it can be someone trying to hack or just a customer who forgot his info.

kikloo

Hi,

As far as i remember osTicket earlier got shutdown becuase it was too buggy and hackers used to hack the osTicket installation. I have installed it in the hope that this has been throughly fixed in this version.

I also know that all apps are not 100% safe, but they should be safe enough i guess so that clients can use it with trust.

I'll check on the settings you have mentioned and update here. Why its showing ../../../../etc/passwd etc. in the email ?

Thanks.

Corey

Why its showing ../../../../etc/passwd etc. in the email ?
Thanks.

They could be trying an old exploit from previous osTicket versions. There are no known vulnerabilities in the latest release. (RC4)

svardaman

That most likely an automated robot security hole scanner. Every public website on the internet gets visits from stuff like that. ../../etc/passwd type attacks aren't common anymore - - it's hoping to read your user file via a hole in a script. I wouldn't worry about it. If you're really paranoid, look in the source or any user input (GET, POST) and clean it to keep about slashes and HTML/Javascript.