CVE-2026-1049
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in LigeroSmart (formerly OTRS) up to version 6.1.26. Attackers can inject malicious scripts via the TicketID parameter in /otrs/index.pl, potentially compromising user sessions or stealing credentials. The vulnerability affects all LigeroSmart installations up to 6.1.26 that are accessible to attackers.
💻 Affected Systems
- LigeroSmart
📦 What is this software?
Ligerosmart by Ligerosmart
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, deface the application, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Attackers would typically steal session cookies or credentials from authenticated users, potentially gaining unauthorized access to the ticketing system.
If Mitigated
With proper input validation and output encoding, the XSS payload would be neutralized, preventing script execution.
🎯 Exploit Status
Exploit details are publicly available in GitHub issue #280. Attack requires user to click a malicious link with crafted TicketID parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor LigeroSmart GitHub repository for updates. Consider upgrading to latest version when patch is released.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize TicketID parameter, allowing only alphanumeric characters.
Implement input validation in /otrs/index.pl to restrict TicketID to expected format
Content Security Policy
allImplement CSP headers to restrict script execution sources.
Add Content-Security-Policy header to web server configuration
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in TicketID parameter
- Restrict access to /otrs/index.pl to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if LigeroSmart version is ≤6.1.26 and test TicketID parameter with XSS payload: <script>alert('XSS')</script>Check Version:
Check LigeroSmart version in administration interface or package managerVerify Fix Applied:
Test with same XSS payload after implementing fixes; script should not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual TicketID parameter values containing script tags or JavaScript in access logs
Network Indicators:
- HTTP requests to /otrs/index.pl with suspicious TicketID parameters
SIEM Query:
source="web_logs" AND uri_path="/otrs/index.pl" AND (TicketID CONTAINS "<script>" OR TicketID CONTAINS "javascript:")