CVE-2026-48237

High

Published: 21/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Risk Assessment

This vulnerability poses a serious risk to data integrity in the database, potentially leading to loss of user trust and financial losses for the organization.

Recommendation

It is recommended to upgrade to version 3.44.2 or later and implement appropriate input sanitization mechanisms in the application.

Original NVD description (English source)

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.