The Open ISES Project version 3.30A is affected by a SQL injection flaw that allows attackers to inject arbitrary SQL code via the tick_lat and tick_lng parameters in nearby.php. The vulnerability is a classic SQL injection (CWE‑89) and enables unauthenticated users to execute queries that can read usernames, database names, and version details, effectively exposing sensitive data stored in the application’s database.

Affected product: Open ISES Project 3.30A. The specific vulnerability targets the nearby.php endpoint and requires no authentication. Users running this version of the Open ISES Project are therefore exposed.

The CVSS score of 8.8 indicates a high severity risk. Because the flaw can be triggered via a standard HTTP GET request and does not require special privileges, the likelihood of exploitation is significant, although an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can deliver the payload to nearby.php, manipulating tick_lat and tick_lng to retrieve or modify database content with relative ease.