CVE-2009-2361: Enhancesoft Osticket

High severity, CVSS 7.5. EPSS: 5.2% chance of exploitation in the next 30 days.

SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter.

Affected products

• Enhancesoft Osticket: up to and including 1.6; version 1.6 only

Published 2009-07-08. Last modified 2026-07-10.