The vulnerability exists in the Open ISES Project version 3.30A. An attacker can send GET requests to add_facnote.php and inject malformed SQL through the ticket_id parameter. The application fails to properly validate or escape the input, enabling arbitrary SQL statements. This flaw is classified as CWE‑89. The result is that an attacker without any authentication can retrieve or manipulate sensitive database content, such as version details and other user data, potentially compromising confidentiality and integrity.

The affected product is the Open ISES Project, specifically release 3.30A. No other versions were explicitly listed as vulnerable in the advisory. The vendor is Open ISES and the product name is the Open ISES Project.

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available and the vulnerability is not catalogued in CISA's KEV. The likely attack vector is network-based via HTTP GET requests to the web application. No authentication or special privileges are required, making the attack trivial to execute under the stated conditions. The exploitation probability remains unknown due to the missing EPSS data, but the high CVSS and lack of mitigations make the risk significant.