GestSup XSS and Access Control Vulnerabilities

Authenticated users of GestSup before 3.2.62 can read private comments belonging to other users' tickets by manipulating the threadedit parameter in thread.php, because the comment loader never verifies that the requester owns the referenced ticket. Any valid account, even a low-privilege self-service one, is enough to iterate sequential comment IDs and harvest confidential ticket discussions over the network with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released version 3.2.62 to close the exposure.

Stored cross-site scripting in GestSup versions before 3.2.62 lets unauthenticated attackers plant arbitrary JavaScript in ticket descriptions and replies by sending crafted emails to a monitored support mailbox, which then executes in a technician's browser when the ticket is opened. The root problem is that the IMAP LOGIN connector fails to sanitize HTML email bodies, so any instance that has that connector enabled and polling an attacker-reachable inbox is exposed; delivery requires no authentication or special privileges, only knowledge or guessing of the mailbox address, and the payload only fires if a technician actually opens the malicious ticket, limiting impact to that technician's authenticated session (ticket data theft and actions performed as that technician) rather than server compromise. A vendor patch is available (fixed in 3.2.62) and no public exploit identified at time of analysis; the issue carries a moderate CVSS of 5.3 and is not confirmed actively exploited (CISA KEV).

Stored cross-site scripting in GestSup versions before 3.2.62 allows unauthenticated attackers to inject JavaScript into technician sessions by emailing a monitored mailbox with nested MIME encoded-words in the subject line; the IMAP OAuth connector double-decodes the subject after HTML escaping, so the decoded payload survives sanitization and is stored with the ticket. Exploitation is feature-gated: the instance must have the IMAP OAuth connector enabled and actively polling a mailbox reachable from outside, and the script only fires when a technician subsequently opens the affected ticket in the web interface (passive user interaction), yielding script execution in the technician's browser rather than direct server-side impact. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); risk is real but moderate given the configuration prerequisites.