An unauthenticated attacker can send specially crafted GET requests to sever_graph.php, exploiting a SQL injection flaw in the p1 parameter. The flaw permits arbitrary SQL queries, enabling extraction of sensitive database contents such as schema names, tables, and data. This results in a loss of data confidentiality and can also allow modification of data, potentially corrupting the system’s integrity.

Open ISES Project version 3.30A is affected. The vulnerability resides in sever_graph.php, which is part of the Open ISES application suite available from the project’s SourceForge release.

The CVSS score of 8.8 indicates a high severity. EPSS information is not available, so the likelihood of exploitation cannot be precisely quantified, but the lack of authentication requirement means that any network user can attempt the attack. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to sever_graph.php, inserting malicious SQL via the unvalidated p1 query parameter.