Which versions of Open ISES Tickets are affected by CVE-2026-48237?

Open ISES Tickets versions before 3.44.2 contains a database vulnerability that authenticated users could exploit to access or modify customer and internal support ticket data.. A patch is available.

How to fix or mitigate CVE-2026-48237?

Within 24 hours: Identify all systems running Open ISES Tickets prior to version 3.44.2 and document data sensitivity. Within 7 days: Apply the vendor-released patch by upgrading to version 3.44.2 or later. Within 30 days: Review access logs since deployment for unauthorized database queries and validate patch effectiveness.

Open ISES Tickets CVE-2026-48237

Q: What is the CVSS score of CVE-2026-48237?

CVE-2026-48237 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31317 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-9cj2-jwj2-wxcc

PHP SQLi Tickets Open Ises

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:35 vuln.today

Analysis Generated

May 21, 2026 - 18:35 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate backend database queries via the message.php endpoint, enabling unauthorized read, modification, or destruction of database contents. The flaw stems from unsanitized concatenation of the frm_ticket_id and frm_resp_id POST parameters into SELECT and UPDATE statements. No public exploit identified at time of analysis, though VulnCheck has published a dedicated advisory and the vendor's 3.44.2 release bundles fixes for 19 SQL injection issues across the codebase.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing/incident-tracking application (CPE: cpe:2.3:a:open_ises:tickets) deployed against MySQL/MariaDB backends, commonly used by emergency services organizations. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the message.php handler interpolates the POST parameters frm_ticket_id and frm_resp_id directly into WHERE clauses of SELECT and UPDATE statements without parameterization or input validation. The vendor's release notes confirm this is one of 19 SQL injection sinks remediated across 11 files in v3.44.2, indicating systemic use of unsafe query construction patterns rather than an isolated coding error.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets v3.44.2 or later, available at https://github.com/openises/tickets/releases/tag/v3.44.2 with the specific commit at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff; Docker users can run 'docker compose pull && docker compose up -d' while traditional installs require extracting the zip over the existing deployment and running the installer in Upgrade mode. Because the 3.44.2 release also remediates 87 additional vulnerabilities including XSS, hardcoded credentials, and SSL validation failures, partial backporting is not advisable - apply the full release. If immediate upgrade is impossible, restrict network access to message.php at the reverse proxy or WAF layer and tighten account provisioning (the PR:L requirement means revoking unused authenticated accounts directly reduces the attack surface), accepting that this breaks ticket update workflows for non-admin users; deploying ModSecurity OWASP CRS rules to block SQL metacharacters in frm_ticket_id and frm_resp_id POST parameters is a more surgical mitigation but may produce false positives on legitimate ticket data containing quotes or comparison operators.