Which versions of Open ISES Tickets are affected by CVE-2026-48238?

Open ISES Tickets prior to version 3.44.2 contains a SQL injection vulnerability in its mobile interface that permits unauthorized manipulation of database records, directly compromising data…. A patch is available.

How to fix or mitigate CVE-2026-48238?

Within 24 hours: Identify all Open ISES Tickets installations and document current versions. Within 7 days: Upgrade all instances to version 3.44.2 or later, testing in a staging environment prior to production deployment. Within 30 days: Confirm successful deployment across all systems and review application logs for evidence of exploitation attempts.

Open ISES Tickets CVE-2026-48238

Q: What is the CVSS score of CVE-2026-48238?

CVE-2026-48238 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31319 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-8wx2-2gr7-3c4q

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:35 vuln.today

Analysis Generated

May 21, 2026 - 18:35 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SELECT statement used as a ticket-existence sanity check without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized id GET parameter in ajax/mobile_main.php. The flaw permits arbitrary read, modification, or destruction of database contents, and is part of a broader batch of 19 SQL injection fixes shipped in v3.44.2. No public exploit identified at time of analysis, but the vendor explicitly classifies v3.44.2 as a 'Critical Security Update' urging immediate upgrade.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing/incident management application (CPE: cpe:2.3:a:open_ises:tickets). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the id GET parameter is concatenated directly into the WHERE clause of a SELECT statement that performs a ticket-existence sanity check in ajax/mobile_main.php, without parameterized queries or input sanitization. Because the vulnerable code path is reached via an AJAX endpoint, classic SQLi techniques such as UNION-based extraction, boolean/time-based blind injection, and stacked queries (where the MySQL/MariaDB driver permits) are directly applicable. The release notes confirm this is one of 19 SQLi issues fixed across 11 files in v3.44.2, indicating systemic unsafe query construction throughout the codebase.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets v3.44.2 or later (https://github.com/openises/tickets/releases/tag/v3.44.2), which fixes this issue alongside 87 other vulnerabilities; the specific commit is https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. Docker deployments can pull the new image with docker compose pull && docker compose up -d, while traditional installs should extract the new zip over the existing tree and run the installer in Upgrade mode. If immediate patching is not feasible, restrict network access to ajax/mobile_main.php (e.g., via a WAF rule blocking SQL metacharacters in the id parameter or denying the endpoint at the reverse proxy), tighten the database user's privileges to remove DDL/DELETE rights where possible, and revoke or audit low-privilege accounts - note that WAF rules can be bypassed by blind/encoded payloads and database privilege reduction may break legitimate ticket workflows, so these are stopgaps only.