Executive brief
The Open ISES Project (also known as Tickets CAD) is an open-source computer-aided dispatch system used by emergency services like fire departments and search and rescue teams. A security flaw allows unauthorized individuals to access the system's underlying database without a password. This could lead to the theft of sensitive emergency response data, personnel records, and system configuration details, potentially disrupting critical public safety operations.
Technical details
A classic SQL injection vulnerability exists in The Open ISES Project version 3.30A due to improper neutralization of special elements in SQL commands (CWE-89). The flaw is accessible via unauthenticated GET and POST requests to several endpoints, most notably the 'id' parameter in 'ajax/form_post.php', the 'tick_lat' and 'tick_lng' parameters in 'nearby.php', and the 'p1' parameter in various graphing scripts. An attacker can exploit this by sending crafted SQL payloads to extract sensitive information from the MySQL/MariaDB database, including schema names, user credentials, and incident data. While the advisory focuses on version 3.30A, users are encouraged to migrate to the modernized 'Tickets CAD' v3.44.1 or later which addresses legacy security issues.
Affected products
- The Open ISES Project The Open ISES Project (Tickets CAD) 3.30A and earlier
Timeline
- 2018-10-18: disclosed: Initial exploit and vulnerability details shared by researcher Ihsan Sencan
- 2026-05-29: advisory: CVE-2018-25400 published/updated via VulnCheck and NVD