Executive brief
Open ISES Tickets is an open-source ticketing system used for managing support requests and communications. A security flaw in the message handling component allows logged-in users to interfere with the underlying database. This could lead to unauthorized access to sensitive ticket information, modification of records, or the deletion of data, potentially disrupting business operations and compromising customer privacy.
Technical details
A SQL injection vulnerability exists in Open ISES Tickets prior to version 3.44.2 within the 'message.php' component. The application fails to sanitize the 'frm_ticket_id' and 'frm_resp_id' POST parameters before concatenating them into SQL WHERE clauses for SELECT and UPDATE statements. An authenticated attacker with network access can exploit this by submitting specially crafted POST requests to manipulate database queries. Successful exploitation allows the attacker to read, modify, or delete database contents. The issue is resolved in version 3.44.2 by implementing proper input validation using functions like intval().
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-04-02: patched: Release of version 3.44.2