The vulnerability is a classic SQL injection flaw in city_graph.php that allows attackers to embed malicious SQL commands via the p1 parameter. Because authentication is not checked, any user can send a crafted GET request to execute arbitrary SQL statements. The resulting impact is the exposure of sensitive database content, including table and schema names, and potentially other confidential data stored in the application database.

The Open ISES Project, version 3.30A, is the affected product. This release is a PHP web application that hosts the city_graph.php script. No other versions or products are listed as impacted.

The CVSS score of 8.8 indicates high severity. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. According to the description, the attack vector is inferred to be a simple unauthenticated HTTP GET request to city_graph.php. Because the flaw allows arbitrary SQL execution without any preliminary authentication or privileged context, the likelihood of exploitation is high among exposed web servers hosting the affected application. The risk is further amplified by the lack of a publicly available patch or workaround in the provided data.