CVE-2026-48239
HighSummary
Open ISES Tickets before version 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.
Risk Assessment
This vulnerability could lead to serious security breaches, allowing attackers to access or modify sensitive data. Organizations may incur financial and reputational losses as a result of this exploit.
Recommendation
It is recommended to update Open ISES Tickets to version 3.44.2 or later to eliminate this vulnerability. Additionally, implementing input data sanitization mechanisms in the application is advisable.
Original NVD description (English source)
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.