Executive brief
Open ISES Tickets, an open-source incident and ticket management system, is vulnerable to a security flaw in its search functionality. An attacker can trick a logged-in user into executing malicious code within their web browser. This could allow the attacker to perform actions on behalf of the user, potentially leading to unauthorized access to sensitive ticket information or administrative functions.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The vulnerability is located in search.php, where the 'frm_query' POST parameter is processed without sufficient sanitization before being rendered into the VALUE attribute of an HTML input field. An authenticated attacker can exploit this by crafting a malicious request that, when executed by a victim, runs arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking or unauthorized data modification. The issue was addressed in version 3.44.2 by implementing htmlspecialchars() with ENT_QUOTES on the affected parameter.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to repository.
- 2026-04-02: advisory: Version 3.44.2 released.
- 2026-05-20: disclosed: CVE published.