[!IMPORTANT] This report is intentionally sanitized for public GitHub publication. Sensitive identifiers, credentials, infrastructure values, and client-specific evidence are replaced with clear placeholders.

🧭 Quick Navigation

• Executive Summary
• Technical Analysis
• Impact
• Remediation
• Lessons Learned & Mitigation Strategy

[!TIP] For a fast review, start with the Executive Summary and Impact sections. For technical depth, continue into Technical Analysis and Remediation.

🏷️ Title

CVE-2026-36214 - osTicket Stored XSS via Bootstrap Tooltip

🧾 Executive Summary

ثغرة أمنية من نوع Cross-Site Scripting (XSS) مخزنة في نظام إدارة التذاكر osTicket (الإصدارات 1.10 حتى 1.17.7 و 1.18.0 حتى 1.18.3)، تنشأ من استخدام مكون Bootstrap Tooltip 3.3.4 المعروف بثغرة CVE-2019-8331.

تسمح هذه الثغرة لمستخدم عادي (غير مُصادق عند إنشاء التذكرة) بحقن كود JavaScript ضار في رسالة التذكرة. عند عرض هذه الرسالة من قبل وكيل (Agent) أو مسؤول (Admin)، يتم تنفيذ الكود في سياق جلستهم، مما يسمح بسرقة الجلسة والتحكم الكامل بنظام التذاكر.

🔬 Technical Analysis

The weakness was assessed from an application-security and infrastructure-risk perspective. The core issue is classified as Stored XSS and was documented in a sanitized form suitable for public portfolio publication.

osTicket هو نظام تذاكر مفتوح المصدر يستخدم على نطاق واسع في المؤسسات. يسمح للمستخدمين برفع محتوى HTML وملفات مرفقة ضمن التذاكر.

📊 Impact

• Execution of attacker-controlled script in trusted user sessions.
• Session abuse, unauthorized actions, and reputational exposure for customer-facing portals.

🛠️ Remediation

🧠 Lessons Learned & Mitigation Strategy

• Treat every integration boundary as untrusted, especially when application logic forwards user-controlled values to filesystems, shells, parsers, or external tools.
• Security reviews should validate the complete exploit chain, not only the first vulnerable endpoint; low-severity misconfigurations can become critical when chained.
• Public-facing documentation should describe risk, root cause, and remediation without exposing operational identifiers, credentials, or reusable exploitation artifacts.
• Defensive controls should combine preventive validation, runtime least privilege, telemetry, and patch governance to reduce both exploitability and blast radius.

🧼 Publication Sanitization Notes

• Sensitive infrastructure identifiers, IP addresses, hostnames, credentials, hashes, and e-mail addresses were replaced with explicit placeholders.
• Reusable operational evidence was minimized or abstracted to keep the document suitable for public GitHub publication.
• The document uses a consultant-style structure aligned with common web security testing report practices such as OWASP WSTG reporting expectations.