CVE-2005-3893: Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2...

Security readout for executives and security teams

This is an old OTRS helpdesk vulnerability where attackers could manipulate database queries through web parameters. In affected versions, the login path could allow authentication bypass, and logged-in users could target ticket and article views. Any still-running legacy OTRS instance deserves prompt attention. Exposure is likely limited to organizations still operating very old OTRS deployments or archived internal helpdesk systems. Publicly reachable index.pl endpoints on affected versions present the highest risk. The source bundle does not identify modern forks or later products as affected. Treat as high priority if legacy OTRS is still reachable, especially from the internet. Authentication bypass and arbitrary SQL can threaten helpdesk data, credentials, and operational continuity. If no affected instance exists, document that result and close as not applicable. Mitigation focus: Inventory OTRS deployments and identify any 1.0.0-1.3.2 or 2.0.0-2.0.3 installations.; Apply vendor or distribution guidance from OTRS advisory OSA-2005-01 or Debian DSA-973.; If a supported fix is unavailable, retire, replace, or strongly isolate the legacy OTRS instance..

Prepared

Jun 29, 2026, 16:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.