An authenticated SQL injection vulnerability in Open ISES Tickets allows attackers to compromise database confidentiality.

This is an SQL injection vulnerability (CWE-89) located in the tables.php script. The vulnerability requires the attacker to have at least low-privileged access to the system to exploit the flaw.

An attacker can leverage this vulnerability to perform unauthorized database queries, risking the exposure of sensitive incident data. With a CVSS score of 7.1, this high-severity issue necessitates prompt attention to prevent potential data breaches that could lead to regulatory or operational impact.

Immediate Action: Update Open ISES Tickets to version 3.44.2 or later.

Proactive Monitoring: Monitor application logs for suspicious database interaction, specifically tracking requests directed at the tables.php file.

Compensating Controls: Utilize a WAF to inspect and block inputs containing SQL syntax or common injection patterns targeting the application.

Public Exploit Available: Unknown

Security teams must treat this vulnerability with high priority. Applying the vendor-supplied update is the most effective method for remediating this security risk and ensuring the continued protection of backend databases.