osTicket Admin Login Blind SQL Injection
osTicket prior to v1.6 RC5 fails to validate / escape staff usernames which can be abused to execute a blind sql injection attack by an unauthenticated attacker.
Page of .