An authenticated SQL injection vulnerability in Open ISES Tickets allows attackers to manipulate database queries through the 'offset' parameter.

This vulnerability is an SQL injection (CWE-89) arising from insufficient input validation of the 'offset' parameter in the ajax-sit-incidents.php script. The vulnerability requires the attacker to be authenticated to the application.

The SQL injection flaw could enable an authenticated attacker to execute arbitrary SQL commands, potentially leading to unauthorized data disclosure or modification. This undermines the security posture of the application and could lead to significant data loss if exploited. The CVSS score of 7.1 underscores the necessity of addressing this flaw promptly.

Immediate Action: Apply the vendor-supplied update by upgrading to Open ISES Tickets version 3.44.2.

Proactive Monitoring: Review application logs for suspicious activity involving the 'offset' parameter in incident-related AJAX requests.

Compensating Controls: Implement WAF rules specifically designed to detect and block SQL injection attempts targeting the identified script and parameter.

Public Exploit Available: Unknown

Security teams should treat this vulnerability with high priority, ensuring that all instances are updated to version 3.44.2. Prompt patching is essential to prevent authenticated users from escalating their privileges or accessing unauthorized database content.