Open ISES Tickets SQLi: Authenticated Attackers Can Corrupt Databases

The National Vulnerability Database has detailed CVE-2026-48231, a critical SQL injection vulnerability in Open ISES Tickets versions prior to 3.44.2. This flaw exists within tables.php, where multiple POST parameters—tablename, indexname, and sortby—are concatenated directly into dynamically constructed SQL statements without proper sanitization. This is a classic injection vector, allowing an attacker to manipulate query logic.

Authenticated attackers can exploit this by crafting malicious requests. The impact is significant: they can alter query semantics to read, modify, or even destroy database contents. While the CVSS score of 7.1 (High) indicates a serious threat, the ‘authenticated’ prerequisite slightly lowers its immediate exploitability compared to unauthenticated flaws. However, any internal or compromised account can leverage this.

This isn’t theoretical. SQL injection remains a top attack vector because it directly compromises data integrity and confidentiality. Defenders must recognize that even ‘high’ severity for an authenticated flaw can quickly escalate to ‘critical’ if an attacker gains initial access through other means, or if default credentials are left unpatched. The attacker’s calculus here is straightforward: get an account, then own the data.