CVE-2018-18922
📋 TL;DR
CVE-2018-18922 is a critical privilege escalation vulnerability in AbiSoft Ticketly 1.0 that allows remote attackers to create administrator accounts via a direct POST request to action/add_user.php. This affects all installations of Ticketly 1.0 that are exposed to untrusted networks. Attackers can gain full administrative control without authentication.
💻 Affected Systems
- AbiSoft Ticketly
📦 What is this software?
Ticketly by Abisoftgt
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise - attackers create admin accounts, take over the application, potentially pivot to underlying systems, and access sensitive ticket data.
Likely Case
Unauthorized administrative access leading to data theft, system manipulation, and further privilege escalation within the application.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external exploitation attempts.
🎯 Exploit Status
Multiple public exploit scripts and detailed walkthroughs exist. Exploitation requires only curl or similar HTTP client tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch exists. Consider upgrading to a different ticketing system or implementing workarounds.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
allRestrict access to action/add_user.php via web server configuration or firewall rules
# Apache: RewriteRule ^action/add_user\.php$ - [F,L]
# Nginx: location ~ /action/add_user\.php$ { deny all; }
Implement authentication middleware
allAdd authentication checks before processing add_user.php requests
# Add session validation at the beginning of action/add_user.php
session_start(); if(!isset($_SESSION['admin'])) { die('Access denied'); }
🧯 If You Can't Patch
- Isolate Ticketly instance behind VPN or internal network only
- Implement strict network ACLs to limit source IPs that can access the application
🔍 How to Verify
Check if Vulnerable:
Send POST request to http://[target]/action/add_user.php with parameters username=testadmin&password=testpass&email=test@test.com&role=admin and check if admin account is createdCheck Version:
Check application files for version information or review installation documentationVerify Fix Applied:
Attempt the same POST request and verify it fails with authentication error or access denied📡 Detection & Monitoring
Log Indicators:
- POST requests to /action/add_user.php
- Successful admin account creation without proper authentication
- Multiple failed authentication attempts followed by add_user.php access
Network Indicators:
- HTTP POST to add_user.php endpoint from unexpected sources
- Traffic patterns showing admin account creation
SIEM Query:
source="web_logs" AND (url="/action/add_user.php" OR url="*/add_user.php") AND method="POST"🔗 References
- https://0day.today/exploit/31658
- https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/
- https://medium.com/%40javierolmedo/cve-2018-18922-ticketly-1-0-privilege-escalation-add-admin-4d1b3696f367
- https://www.exploit-db.com/exploits/45892
- https://0day.today/exploit/31658
- https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/
- https://medium.com/%40javierolmedo/cve-2018-18922-ticketly-1-0-privilege-escalation-add-admin-4d1b3696f367
- https://www.exploit-db.com/exploits/45892
