Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR

Proof of Concept

1. Create a ticket using a user with Subscriber privileges.
2. Click on "Close Ticket" and intercept the request using an HTTP Proxy (e.g., BurpSuite). 
3. Change the value of the "post_ID" parameter to another existing Ticket ID.

Note: Since the Ticket ID (post_ID) is an incremental numerical value, it is easy to brute force it and affect all existing tickets.