Description
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the ticket_id parameter. Attackers can send GET requests to add_facnote.php with crafted SQL payloads to extract sensitive database information including version details and other data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open ISES | Open ISES Project | 3.30A | — |
References
- ExploitDB-45645 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: The Open ISES Project 3.30A SQL Injection via add_facnote.php third-party-advisory