Executive brief
The Open ISES Project (Tickets CAD) is an open-source computer-aided dispatch system used by emergency services like fire departments and EMS agencies. A security flaw allows unauthenticated attackers to access the underlying database, potentially exposing sensitive emergency response data, personnel records, and system configurations. This could lead to a significant breach of privacy and operational security for organizations relying on the software.
Technical details
Multiple SQL injection vulnerabilities exist in The Open ISES Project version 3.30A. The flaws are caused by improper neutralization of user-supplied input in several PHP components, including sever_graph.php (p1 parameter), nearby.php (tick_lat and tick_lng parameters), and ajax/form_post.php (id and ticket_id parameters). An unauthenticated remote attacker can exploit these by sending specially crafted GET or POST requests containing SQL payloads. Successful exploitation allows the attacker to bypass authentication, extract sensitive data such as database schemas, user credentials, and personnel records, and potentially modify database content. While the project has since evolved into 'Tickets CAD' with newer versions (v3.44.1+), users of the legacy 3.30A version remain vulnerable.
Affected products
- Open ISES Project The Open ISES Project (Tickets CAD) 3.30A and earlier
Timeline
- 2018-10-18: disclosed: Initial discovery and proof-of-concept by Ihsan Sencan
- 2026-05-29: advisory: CVE-2018-25401 published/updated via VulnCheck and NVD