Executive brief
The Open ISES Project (Tickets CAD), a computer-aided dispatch system used by emergency services and volunteer organizations, contains a security flaw that allows unauthorized individuals to access its database. By sending specially crafted web requests, an attacker can bypass security controls to view sensitive information, including system configurations and user data. This could lead to the exposure of critical emergency response data and compromise the privacy of personnel and operations.
Technical details
A classic SQL injection vulnerability exists in The Open ISES Project version 3.30A and potentially earlier. The application fails to properly sanitize user-supplied input in several components, most notably the 'p1' parameter in inc_types_graph.php, sever_graph.php, and city_graph.php, as well as parameters in nearby.php and main.php. An unauthenticated remote attacker can exploit this by sending crafted GET or POST requests containing SQL payloads. Successful exploitation allows the attacker to extract sensitive information from the database, including schema details, user credentials, and version information, using techniques such as error-based or union-based SQL injection.
Affected products
- The Open ISES Project The Open ISES Project (Tickets CAD) 3.30A and earlier
Timeline
- 2018-10-18: disclosed: Initial discovery and proof-of-concept by researcher Ihsan Sencan
- 2026-05-29: advisory: NVD/VulnCheck advisory published