Executive brief
The Open ISES Project (also known as Tickets CAD) is an open-source computer-aided dispatch system used by emergency services and volunteer organizations. A security flaw allows unauthorized individuals to access and extract sensitive information from the system's database. This could lead to the exposure of confidential dispatch records, personnel data, and system configuration details, potentially compromising emergency operations.
Technical details
An SQL injection vulnerability exists in The Open ISES Project version 3.30A and potentially earlier versions. The flaw is rooted in improper neutralization of special elements in several PHP scripts, most notably add_facnote.php via the 'ticket_id' parameter, but also affecting main.php, nearby.php, and various graph-related scripts. An unauthenticated remote attacker can exploit this by sending specially crafted GET or POST requests containing malicious SQL payloads. Successful exploitation allows the attacker to execute arbitrary SQL commands, enabling the extraction of sensitive database information such as version details, schema structure, and user data. While the project has since evolved into 'Tickets CAD' with newer versions (v3.44.1+), users of the legacy 3.30A version remain vulnerable.
Affected products
- The Open ISES Project The Open ISES Project (Tickets CAD) 3.30A and earlier
Timeline
- 2018-10-18: disclosed: Initial discovery and proof-of-concept published by researcher Ihsan Sencan
- 2026-05-29: advisory: CVE record published/updated via VulnCheck