Executive brief
The Open ISES Project (also known as Tickets CAD) is an open-source computer-aided dispatch system used by emergency services and volunteer organizations to manage incidents and responders. A security flaw in the system's login and reporting components allows unauthorized individuals to access the underlying database. This could lead to the theft of sensitive information, including user credentials, responder details, and incident logs, potentially disrupting emergency operations.
Technical details
Multiple SQL injection vulnerabilities exist in The Open ISES Project version 3.30A and earlier. The primary flaw is located in the 'frm_passwd' parameter of 'main.php', where insufficient input sanitization allows unauthenticated attackers to execute arbitrary SQL commands via POST requests. Additional vulnerable endpoints include 'nearby.php' (tick_lat/tick_lng parameters), 'ajax/form_post.php' (id/ticket_id parameters), and various graphing scripts ('sever_graph.php', 'inc_types_graph.php', 'city_graph.php'). Attackers can exploit these to extract sensitive database information, including usernames, database schemas, and version details. While the software has evolved into 'Tickets CAD' (v3.44.1+), users of the legacy 3.30A version remain vulnerable.
Affected products
- The Open ISES Project The Open ISES Project (Tickets CAD) 3.30A and earlier
Timeline
- 2018-10-18: disclosed: Initial exploit proof-of-concept published on Exploit-DB
- 2026-05-29: advisory: CVE-2018-25398 assigned and published via VulnCheck/NVD