Which versions of Open ISES Tickets are affected by CVE-2026-48234?

A SQL injection vulnerability in Open ISES Tickets versions below 3.44.2 allows authenticated users to manipulate database queries, exposing sensitive support ticket data and enabling unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-48234?

Within 24 hours: Identify and inventory all systems running Open ISES Tickets; confirm current version and review access logs for suspicious database queries. Within 7 days: Upgrade all instances to version 3.44.2; validate patch in staging environment before production deployment. Within 30 days: Confirm patch deployment across all systems; conduct security scan to verify vulnerability remediation.

Open ISES Tickets CVE-2026-48234

Q: What is the CVSS score of CVE-2026-48234?

CVE-2026-48234 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31316 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-646p-2m5f-7gm9

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:34 vuln.today

Analysis Generated

May 21, 2026 - 18:34 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated into the ORDER BY clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate ORDER BY clauses via the sort and dir GET parameters in portal/ajax/list_requests.php, enabling unauthorized read, modification, or destruction of database contents. The CVSS 4.0 score of 7.1 reflects network-reachable exploitation with low privileges and no user interaction required. No public exploit identified at time of analysis, but the vendor's own release notes describe this as part of a critical security update patching 19 SQL injection flaws across 11 files.

Technical ContextAI

Open ISES Tickets is a PHP-based incident management and dispatch portal used in emergency services contexts. The flaw is a classic CWE-89 SQL Injection where user-controlled GET parameters (sort, dir) are concatenated directly into an ORDER BY clause in a SELECT statement. ORDER BY injection is particularly insidious because the values cannot be safely bound via prepared statements like WHERE clause parameters can - they must be validated against an allowlist of column names and sort directions, which the vulnerable code fails to do. The affected CPE is cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:* covering all versions below 3.44.2.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets version 3.44.2 or later, available at https://github.com/openises/tickets/releases/tag/v3.44.2 with the specific code change at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. Docker users can run 'docker compose pull && docker compose up -d', and traditional installs can extract the new zip over the existing installation and run the installer in Upgrade mode. If immediate patching is not possible, restrict portal access via network ACLs or a reverse-proxy authentication layer to known administrative IPs, and consider disabling or blocking requests to portal/ajax/list_requests.php at a WAF - though this will break the request listing/sorting UI feature for legitimate users. Note that v3.44.2 also removes 5 hardcoded secrets and fixes 68 other XSS/SQLi/configuration issues, so credential rotation (API keys, database passwords) is advisable after upgrade.