Executive brief
Open ISES Tickets, a support ticketing system, contains hardcoded database credentials within its source code. An attacker who discovers these credentials can gain full access to the underlying database, allowing them to view, modify, or delete sensitive customer information and system data. This could lead to a total compromise of the ticketing platform and loss of data integrity.
Technical details
Open ISES Tickets versions prior to 3.44.2 suffer from the use of hardcoded credentials (CWE-798) within the 'loader.php' utility. The MySQL database username, password, and database name were committed directly to the public source repository. An unauthenticated remote attacker can retrieve these credentials by reading the file on a deployed instance or via the public source tree. If the database port is exposed to the network, the attacker can use these credentials to gain full administrative access to the database, leading to unauthorized data exfiltration or modification. The issue was resolved in version 3.44.2 by removing the hardcoded secrets.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fixes committed to repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-21: disclosed: CVE-2026-48241 published