The Open ISES Project 3.30A allows an attacker to inject arbitrary SQL through the p1 parameter of inc_types_graph.php. By sending specially crafted GET requests, a malicious actor can execute arbitrary queries against the database, enabling extraction of sensitive schema information and other data. The vulnerability is a classic CWE‑89 SQL injection and results in a compromise of both data confidentiality and integrity, with no authentication required to exploit it.

Open ISES Project Open ISES 3.30A is the only affected product. The flaw resides in the inc_types_graph.php module and can leverage any database used by that version.

The CVSS score of 8.8 indicates a high severity level, while the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is straightforward: a public HTTP GET request to inc_types_graph.php with a malicious p1 payload. Because no authentication is needed, the risk for any exposed instance is significant, and exploitation could occur with minimal effort once the URLs are known.