CVE-2026-48213 — Add.Php That Cross-Site Scripting (XSS)

title: CVE-2026-48213 - Reflected XSS in Open ISES Tickets add.php
id: scw-2026-05-21-ai-1
status: experimental
level: medium
description: |
  Detects a reflected Cross-Site Scripting (XSS) vulnerability in Open ISES Tickets version prior to 3.44.2. This rule specifically targets the add.php script and the 'ticket_id' POST parameter, which is known to be unsanitized. Attackers can inject JavaScript payloads that execute in the victim's browser when the response is rendered. This rule looks for the specific URI path and parameter, along with common XSS payload indicators within the request.
author: SCW Feed Engine (AI-generated)
date: 2026-05-21
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-48213/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri: 
          - '/add.php'
      cs-method: 
          - 'POST'
      cs-uri-query|contains:
          - 'ticket_id='
      # The actual payload would be injected into the ticket_id parameter, 
      # so we look for common XSS patterns within the POST data (represented by cs-uri-query here for simplicity, 
      # assuming the webserver logs this parameter in the query string or POST body). 
      # A more robust rule might require inspecting POST body content if available.
      # Example payload indicators:
      cs-uri-query|contains:
          - '<script>alert(' 
          - 'onerror=alert(' 
          - 'javascript:alert(' 
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse