Which versions of Open ISES Tickets are affected by CVE-2026-48233?

Open ISES Tickets versions prior to 3.44.2 contain a SQL injection vulnerability accessible to authenticated users that enables unauthorized database manipulation and potential exposure of sensitive…. A patch is available.

How to fix or mitigate CVE-2026-48233?

Within 24 hours: Inventory all instances of Open ISES Tickets and document current versions. Within 7 days: Apply vendor patch and upgrade all affected systems to Open ISES Tickets 3.44.2 or later. Within 30 days: Perform full database integrity audit and review application logs for suspicious query patterns dating back to deployment of the affected version.

Open ISES Tickets CVE-2026-48233

Q: What is the CVSS score of CVE-2026-48233?

CVE-2026-48233 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31313 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-98vj-g6hr-4rr2

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:32 vuln.today

Analysis Generated

May 21, 2026 - 18:32 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets prior to 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized 'offset' GET parameter in ajax/sit_incidents.php, which is concatenated directly into a LIMIT clause. Successful exploitation enables reading, modifying, or destroying database contents. No public exploit identified at time of analysis, though the underlying flaw is one of 19 SQL injection issues patched in the same release, indicating broad code-level weakness.

Technical ContextAI

Open ISES Tickets is a PHP-based incident/ticket tracking application (CPE: cpe:2.3:a:open_ises:tickets) commonly deployed against MariaDB/MySQL backends. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) - specifically, the 'offset' GET parameter accepted by the ajax/sit_incidents.php endpoint is concatenated directly into the LIMIT clause of a SELECT statement without parameterization, type-casting, or input validation. Because LIMIT-clause injection has historically been considered harder to exploit than WHERE-clause injection, developers sometimes omit hardening here, but modern MySQL/MariaDB still permit subquery and UNION-based payloads in this position, enabling full query semantics manipulation.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets 3.44.2 or later, which the maintainers describe as a critical security release addressing this issue alongside 18 other SQL injection and 69 XSS vulnerabilities (https://github.com/openises/tickets/releases/tag/v3.44.2). Docker users can run 'docker compose pull && docker compose up -d', while traditional installs should extract the new release over the existing tree and run the installer in Upgrade mode. If immediate patching is not possible, restrict network access to authenticated internal users only, place the application behind a WAF with rules blocking SQL metacharacters or non-numeric values in the 'offset' parameter to ajax/sit_incidents.php (trade-off: may break legitimate pagination with unusual values), and rotate any credentials previously exposed to the application - also rotate any of the five hardcoded secrets that shipped in pre-3.44.2 versions, since the release notes confirm their removal. Default admin/admin credentials referenced in the Docker quick-start must be changed to eliminate the trivial low-privilege foothold.