LigeroSmart Cross-Site Scripting Vulnerability in AgentTicketZoom Function

A cross-site scripting (XSS) vulnerability has been identified in LigeroSmart versions up to 6.1.26. The issue arises in the file '/otrs/index.pl' when the 'Action=AgentTicketZoom' parameter is used. Manipulating the 'TicketID' argument triggers the vulnerability, allowing remote attacks. The problem has been publicly disclosed, but the LigeroSmart project has not yet responded to the issue report.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to '/otrs/index.pl' with the 'Action' parameter set to 'AgentTicketZoom' and the 'TicketID' parameter manipulated to include a script payload, such as an alert command. Ensure that the request includes the necessary cookies and headers to mimic a legitimate user session.