Open ISES Tickets vulnerabilities

Insufficient state checks allow bypassing two-factor authentication (2FA) controls.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests during the mobile (RouteMate) login flow. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before version 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false. An attacker on the network path can present a forged certificate to intercept authentication data.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing general-purpose outbound HTTPS requests via shared helper functions. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

Open ISES Tickets before version 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.

In Open ISES Tickets before 3.44.2, hardcoded MySQL database credentials (host, username, password, database name) are present in import_mdb.php. These credentials are publicly available in the source repository.

Open ISES Tickets before version 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements without sanitization. Authenticated attackers can craft requests to read, modify, or destroy database contents.

Open ISES Tickets before 3.44.2 has an SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/mobile_main.php. The GET parameter 'id' is concatenated into the WHERE clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in message.php. POST parameters 'frm_ticket_id' and 'frm_resp_id' are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in db_loader.php. POST parameters 'ticketsdb', 'ticketshost', 'ticketsuser', 'ticketspassword' are concatenated into mysqli connection arguments and dynamic SQL without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 has a SQL injection vulnerability in incs/remotes.inc.php. Values like latitude, longitude, callsign, mph, altitude, and timestamp from external GPS services are concatenated into UPDATE and INSERT statements without sanitization.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in portal/ajax/list_requests.php. GET parameters 'sort' and 'dir' are concatenated into the ORDER BY clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/sit_incidents.php. GET parameter 'offset' is concatenated into the LIMIT clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/fullsit_incidents.php. GET parameter 'offset' is concatenated into the LIMIT clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in tables.php. POST parameters 'tablename', 'indexname', 'sortby' are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ticketsmdb_import.php. An authenticated attacker can inject arbitrary JavaScript via multiple POST parameters that are directly placed into HTML form hidden input value attributes.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in routes_i.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the value attribute of a hidden HTML form input.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in patient_w.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized id and ticket_id GET parameters that are directly placed into the action attribute of an HTML form.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in patient.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized id and ticket_id GET parameters that are directly placed into the action attribute of an HTML form.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in os_watch.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized ref and mode_orig POST parameters that are directly placed into the value attributes of hidden HTML form inputs.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in landb.php. An authenticated attacker can inject arbitrary JavaScript via the _type POST parameter, which is directly placed into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php. It allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213rr.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205a.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics202.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in icons/buttons/landb.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters frm_name and frm_id, which are directly rendered into HTML and inline JavaScript.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in delete_module.php. An authenticated attacker can inject arbitrary JavaScript via multiple POST parameters (module_choice, flag, confirmation) that are directly placed into rendered HTML content and form action attributes.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in db_loader.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema) directly into HTML form input value attributes.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in circle.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the frm_id POST parameter directly into an HTML form input value attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_nm.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the ticket_id POST parameter directly into an HTML form input value attribute and an inline JavaScript string literal.

Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in add.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id POST parameter that is directly placed into the value attribute of an HTML form input.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_query POST parameter directly into an HTML input field VALUE attribute. Attackers can craft a malicious request containing a JavaScript payload in the frm_query parameter that executes in the victim's browser when submitted.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim's browser when the URL is visited.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in routes_nm.php, where the ticket_id parameter is passed unsanitized into the VALUE attribute of a hidden input field. An authenticated attacker can inject JavaScript via a crafted URL.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary JavaScript by passing unsanitized values through the thelat and thelng GET parameters directly into JavaScript variable assignments. Attackers can craft a malicious URL containing a JavaScript payload in either parameter that executes in the victim's browser when the URL is visited.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_facnote.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in opena.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized frm_call GET parameter that is directly output on the page.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in patient_JF.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into a JavaScript variable assignment.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_note.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into an HTML attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single_unit.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized id GET parameter that is directly placed into an HTML attribute.