CVE-2025-10692: OpenSupports SQL Injection Vulnerability

CVE-2025-10692 Overview

CVE-2025-10692 is a SQL injection vulnerability in OpenSupports 4.11.0. The flaw exists in the POST /api/staff/get-new-tickets endpoint, which concatenates the user-controlled departmentId parameter directly into a SQL WHERE clause without parameter binding. An authenticated staff user with privilege level greater than or equal to 1 can inject SQL syntax to manipulate the filter logic. Successful exploitation bypasses department-based access scoping and discloses tickets the user is not authorized to view. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated staff users can bypass department access controls and read tickets belonging to other departments through SQL injection in the departmentId parameter.

Affected Products

OpenSupports 4.11.0
POST /api/staff/get-new-tickets endpoint
Staff-facing ticket management functionality

Discovery Timeline

2025-10-03 - CVE-2025-10692 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10692

Vulnerability Analysis

The vulnerability resides in the staff ticket retrieval endpoint of OpenSupports, an open-source help desk and ticketing platform. The backend handler for POST /api/staff/get-new-tickets accepts a departmentId parameter intended to scope ticket queries to a specific department. Rather than passing this value through prepared statements or parameterized queries, the application concatenates the raw input into the SQL WHERE clause.

An authenticated staff user with level ≥ 1 can submit crafted input that alters the SQL query structure. The injected logic changes how rows are filtered, returning ticket records that fall outside the requester's authorized department scope. This violates the application's authorization model by leveraging a data-layer flaw to bypass business-logic boundaries.

The issue is a textbook instance of CWE-89, where untrusted input becomes part of executable SQL. Because the attack requires only low-privilege staff credentials and no user interaction, it is straightforward to exploit in any deployment where multiple departments share an OpenSupports instance.

Root Cause

The backend constructs SQL queries using string concatenation that includes the departmentId value supplied by the client. The application omits parameter binding, type casting, and allowlist validation for this field. Any staff session with level ≥ 1 can therefore submit non-numeric SQL fragments that the database engine interprets as query syntax.

Attack Vector

Exploitation requires network access to the OpenSupports API and valid staff credentials. The attacker sends a POST request to /api/staff/get-new-tickets with a malicious departmentId value containing SQL operators or clauses. The injected expression manipulates the WHERE predicate to evaluate true for tickets outside the attacker's department. Refer to the Fluid Attacks Security Advisory for technical details of the proof of concept.

Detection Methods for CVE-2025-10692

Indicators of Compromise

HTTP POST requests to /api/staff/get-new-tickets containing SQL keywords such as OR, UNION, SELECT, or comment sequences (--, /*) in the departmentId field.
Non-numeric values submitted for departmentId from authenticated staff sessions.
Application or database logs showing unexpected query patterns or syntax errors originating from the staff tickets endpoint.
Audit-log entries where staff users access ticket IDs outside their assigned department.

Detection Strategies

Inspect web server and application logs for requests to /api/staff/get-new-tickets and flag any departmentId value that is not a positive integer.
Deploy a web application firewall (WAF) rule set tuned to detect SQL injection payloads against the OpenSupports API surface.
Enable database query logging and alert on anomalous WHERE clauses or boolean tautologies originating from the OpenSupports service account.

Monitoring Recommendations

Correlate staff authentication events with subsequent ticket access patterns to surface cross-department reads.
Baseline normal departmentId values per staff user and alert on deviations.
Forward OpenSupports application logs, reverse proxy logs, and database audit logs to a centralized analytics platform for joint analysis.

How to Mitigate CVE-2025-10692

Immediate Actions Required

Restrict access to the OpenSupports staff API to trusted networks or VPN segments until a patched build is deployed.
Review staff accounts and revoke or downgrade any accounts that do not require level ≥ 1 access.
Audit ticket access logs for the period preceding patching to identify any unauthorized cross-department disclosure.

Patch Information

No vendor patch has been linked in the NVD entry at the time of publication. Monitor the OpenSupports GitHub repository for fixed releases beyond 4.11.0 and consult the Fluid Attacks Security Advisory for remediation guidance.

Workarounds

Place a reverse proxy or WAF in front of OpenSupports that validates departmentId as a strict integer before forwarding requests.
Apply a local source-code modification that casts departmentId to an integer or rejects non-numeric input prior to query construction.
Limit staff account provisioning and enforce least-privilege role assignments to reduce the population of users able to reach the vulnerable endpoint.

bash

# Example NGINX request validation for the vulnerable endpoint
location = /api/staff/get-new-tickets {
    if ($request_method = POST) {
        if ($arg_departmentId !~ "^[0-9]+$") {
            return 400;
        }
    }
    proxy_pass http://opensupports_backend;
}