CVE-2026-48236

High

Published: 21/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in db_loader.php where multiple POST parameters are concatenated into mysqli connection arguments. Authenticated attackers can modify queries, allowing them to read, modify, or destroy database contents.

Risk Assessment

This vulnerability poses a serious risk to data integrity in the database, allowing attackers to manipulate data within the system. It could lead to data loss or unauthorized modification.

Recommendation

It is recommended to upgrade to version 3.44.2 or later to eliminate this vulnerability. Additionally, implementing proper input sanitization mechanisms is advisable.

Original NVD description (English source)

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into mysqli connection arguments and dynamic SQL operating against an attacker-controlled database without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.