Description
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the ajax/form_post.php endpoint with crafted SQL payloads to extract sensitive database information including schema names and other data.
Published: 2026-05-29
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a classic SQL injection flaw located in the 'id' parameter of the ajax/form_post.php script. Unauthenticated attackers can forge GET requests containing malicious SQL, allowing them to execute arbitrary database commands, read schema information, and extract sensitive data. The impact is primarily a loss of confidentiality and potential integrity breach of the underlying database used by the application.

Affected Systems

The affected product is Open ISES Project version 3.30A. No other versions were listed as impacted, so any deployment using 3.30A of this project is susceptible.

Risk and Exploitability

This flaw carries a CVSS score of 8.8, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploit code at the time of this analysis. Attackers can reach the vulnerability without authentication by sending crafted GET requests to ajax/form_post.php, making it straightforward to enumerate database schemas or exfiltrate data. The lack of a known exploit does not reduce the risk, as the vector is simple and the impact severe.

Generated by OpenCVE AI on May 29, 2026 at 17:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Open ISES Project to the latest release available from SourceForge to apply the vendor’s fix
  • Restrict unauthenticated access to ajax/form_post.php by enforcing authentication or firewall rules
  • Validate and sanitize the 'id' parameter in all requests, using parameterized queries or escaping to eliminate SQL injection vectors

Generated by OpenCVE AI on May 29, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 29 May 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 29 May 2026 16:15:00 +0000

Type Values Removed Values Added
Description The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the ajax/form_post.php endpoint with crafted SQL payloads to extract sensitive database information including schema names and other data.
Title The Open ISES Project 3.30A SQL Injection via form_post.php
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-29T20:38:39.041Z

Reserved: 2026-05-29T12:59:23.785Z

Link: CVE-2018-25400

cve-icon Vulnrichment

Updated: 2026-05-29T20:38:35.819Z

cve-icon NVD

Status : Deferred

Published: 2026-05-29T16:16:19.627

Modified: 2026-05-29T16:32:14.400

Link: CVE-2018-25400

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T17:30:04Z

Weaknesses