Description
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the tick_lat and tick_lng parameters. Attackers can send GET requests to nearby.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open ISES | Open ISES Project | 3.30A | — |
References
- ExploitDB-45645 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: The Open ISES Project 3.30A SQL Injection via nearby.php third-party-advisory