An authenticated SQL injection vulnerability in Open ISES Tickets allows attackers to access sensitive database information.

This vulnerability is an Improper Neutralization of Special Elements used in an SQL Command (CWE-89). It requires low-privileged authenticated access to trigger the flaw within the ajax-fullsit-incidents.php component.

Successful exploitation allows an attacker to manipulate SQL queries, potentially leading to unauthorized data exfiltration from the application's backend database. While the CVSS score of 7.1 (High) reflects the requirement for authentication, the ability to compromise data confidentiality poses a significant risk to organizational data integrity and compliance.

Immediate Action: Update Open ISES Tickets to version 3.44.2 or later immediately.

Proactive Monitoring: Review database query logs for unusual patterns or syntax errors that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious payloads targeting the application's AJAX endpoints.

Public Exploit Available: Unknown

Given the potential for unauthorized data access, administrators should prioritize updating the affected software to the patched version. Implementing the recommended patch is the only definitive way to eliminate the vulnerability.