CVE-2026-48235: SQLi in Open ISES Tickets via GPS Data

The National Vulnerability Database has disclosed CVE-2026-48235, a high-severity SQL injection vulnerability (CVSS 8.2) impacting Open ISES Tickets versions prior to 3.44.2. The flaw exists in incs/remotes.inc.php, where latitude, longitude, callsign, mph, altitude, and timestamp values, parsed from external GPS tracking service XML/JSON responses (InstaMapper and Google Latitude integration), are concatenated directly into UPDATE and INSERT statements without adequate sanitization.

This is a classic SQLi scenario. An attacker who can compromise or impersonate a remote GPS tracker endpoint can inject malicious SQL. This allows them to manipulate critical data within the responder location, tracks, and assignment tables. The implications are severe: an adversary could falsify responder locations, erase track histories, or even alter assignment data, leading to operational chaos and potential physical risks in emergency response scenarios.

While specific affected products beyond ‘Open ISES Tickets’ are not detailed by the National Vulnerability Database, organizations utilizing this system, particularly those integrating with InstaMapper or Google Latitude for GPS tracking, are directly exposed. The vulnerability’s high score reflects its network-exploitable nature with no user interaction required, making it a critical concern for any deployed instance.