CVE-2026-57652: JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule

--- a/js-support-ticket/includes/activation.php
+++ b/js-support-ticket/includes/activation.php
@@ -201,8 +201,8 @@
                     ('tplink_faqs_user', '0', 'tplink', 'faq'),
                     ('show_breadcrumbs', '1', 'default', NULL),
                     ('productcode', 'jsticket', 'default', NULL),
-                    ('versioncode', '3.1.0', 'default', NULL),
-                    ('productversion', '310', 'default', NULL),
+                    ('versioncode', '3.1.1', 'default', NULL),
+                    ('productversion', '311', 'default', NULL),
                     ('producttype', 'free', 'default', NULL),
                     ('tve_enabled', '2', 'default', NULL),
                     ('tve_mailreadtype', '3', 'default', NULL),
--- a/js-support-ticket/includes/classes/uploads.php
+++ b/js-support-ticket/includes/classes/uploads.php
@@ -406,6 +406,7 @@
         if(!isset($_FILES[$jsst_field])){
             return;
         }
+        $jsst_filename = '';
         if (!function_exists('wp_handle_upload')) {
             do_action('jssupportticket_load_wp_file');
         }
--- a/js-support-ticket/js-support-ticket.php
+++ b/js-support-ticket/js-support-ticket.php
@@ -5,7 +5,7 @@
   Plugin URI: https://www.jshelpdesk.com
   Description: JS Help Desk is a trusted open source ticket system. JS Help Desk is a simple, easy to use, web-based customer support system. User can create ticket from front-end. JS Help Desk comes packed with lot features than most of the expensive(and complex) support ticket system on market. JS Help Desk provide you best industry help desk system.
   Author: JS Help Desk
-  Version: 3.1.0
+  Version: 3.1.1
   Text Domain: js-support-ticket
   Domain Path: /languages
   License: GPLv3
@@ -63,7 +63,7 @@
         self::$jsst_data = array();
         self::$_search = array();
         self::$_captcha = array();
-        self::$_currentversion = '310';
+        self::$_currentversion = '311';
         self::$_addon_query = array('select'=>'','join'=>'','where'=>'');
         self::$_jshdsession = JSSTincluder::getObjectClass('wphdsession');
         global $wpdb;
@@ -143,7 +143,7 @@
                     // restore colors data end
                     update_option('jsst_currentversion', self::$_currentversion);
                     include_once JSST_PLUGIN_PATH . 'includes/updates/updates.php';
-                    JSSTupdates::checkUpdates('310');
+                    JSSTupdates::checkUpdates('311');
                     JSSTincluder::getJSModel('jssupportticket')->updateColorFile();
                     JSSTincluder::getJSModel('jssupportticket')->jsst_check_license_status();
                     JSSTincluder::getJSModel('jssupportticket')->JSSTAddonsAutoUpdate();
--- a/js-support-ticket/modules/attachment/model.php
+++ b/js-support-ticket/modules/attachment/model.php
@@ -198,6 +198,33 @@
             return false;
         }

+        // --- ADDED SECURITY CHECK: Copied from getDownloadAttachmentById ---
+        $jsst_ticketid = intval($jsst_id);
+        $jsst_download = false;
+
+        if(!JSSTincluder::getObjectClass('user')->isguest()){
+            if(current_user_can('manage_options') || current_user_can('jsst_support_ticket_tickets') ){
+                $jsst_download = true;
+            }else{
+                if( in_array('agent',jssupportticket::$_active_addons) && JSSTincluder::getJSModel('agent')->isUserStaff()){
+                    $jsst_download = true;
+                }else{
+                    if(JSSTincluder::getJSModel('ticket')->validateTicketDetailForUser($jsst_ticketid)){
+                        $jsst_download = true;
+                    }
+                }
+            }
+        }else{ // user is visitor
+            $jsst_download = JSSTincluder::getJSModel('ticket')->validateTicketDetailForVisitor($jsst_ticketid);
+        }
+
+        // If the user fails all checks, block the download and show a 404 page
+        if ($jsst_download != true) {
+            include( get_query_template( '404' ) );
+            exit;
+        }
+        // -------------------------------------------------------------------
+
         $jsst_filename = jssupportticketphplib::JSST_str_replace(' ', '_', $jsst_file_name);
         $jsst_filename = jssupportticketphplib::JSST_clean_file_path($jsst_filename);

@@ -253,7 +280,7 @@
         flush();

         // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
-        echo $wp_filesystem->get_contents($jsst_file);
+        echo $jsst_wp_filesystem->get_contents($jsst_file);
         exit;
     }

--- a/js-support-ticket/modules/jssupportticket/controller.php
+++ b/js-support-ticket/modules/jssupportticket/controller.php
@@ -22,7 +22,7 @@
                 case 'controlpanel':
                     JSSTincluder::getJSModel('jssupportticket')->getControlPanelData();
                     include_once JSST_PLUGIN_PATH . 'includes/updates/updates.php';
-                    JSSTupdates::checkUpdates('310');
+                    JSSTupdates::checkUpdates('311');
                     JSSTincluder::getJSModel('jssupportticket')->updateColorFile();
                     //JSSTincluder::getJSModel('jssupportticket')->getStaffControlPanelData();
                     break;
--- a/js-support-ticket/modules/zywrap/controller.php
+++ b/js-support-ticket/modules/zywrap/controller.php
@@ -16,7 +16,7 @@
             switch ($jsst_layout) {
                 case 'admin_zywrap':
                     include_once JSST_PLUGIN_PATH . 'includes/updates/updates.php';
-                    JSSTupdates::checkUpdates('310');
+                    JSSTupdates::checkUpdates('311');
                     JSSTincluder::getJSModel('zywrap')->getDashboardStats();
                     break;