We've tried to contact authors from "contact" page, bu still no answer received. So, we decided to publish security alert here.

[Summary]
Insufficient filtration of user input data can lead to SQL injection
vulnerability and arbitrary file including.

[Details]

-----------[SQL injection]----------
Vulnerable script: class.ticket.php
Vulnerable code:
--

Code:
--
function CloseTicket($ticket) {
        mysql_query("UPDATE tickets SET status = 'closed' WHERE ID=$ticket");  // - SQL injection
}
-[skip]-
function ReopenTicket($ticket) {
        mysql_query("UPDATE tickets SET status='open' WHERE ID=$ticket");      // - SQL injection
}
-[skip]-
function PostMessage($ticket, $message, $headers='', $notify=true) {
    global $config;
        $headers = $config[save_headers] ? $headers: "";
        $gmtime = (time() - date("Z")) + 3600;
        
        ReopenTicket($ticket);
        mysql_query("INSERT INTO ticket_messages (ticket, message, headers, timestamp) 
        VALUES($ticket, '" . addslashes(striptags($message)) .                 // - SQL injection 
        "', '" . addslashes($headers) . "', FROM_UNIXTIME('$gmtime') + 0)");

    if ($config[alert_new]) {
           email_alert($ticket, mysql_insert_id());
        }
        
        $t = mysql_fetch_array(mysql_query
        ("SELECT email, cat FROM tickets WHERE ID=$ticket"));                  // - SQL injection
--

Code:
--
 include(INCLUDE_DIR."/$inc.php"); 
--