The vulnerability exists in the landb.php script of Open ISES Tickets. An authenticated attacker can exploit an unsanitized _type POST parameter that is echoed directly into an HTML hidden input value attribute. This results in reflected cross-site scripting, enabling the attacker to run arbitrary JavaScript on the victim’s browser when the response is rendered. The consequences include session hijacking, data theft, and possible defacement of the application, as the attack is performed within the context of the authenticated user’s session.

All versions of Open ISES Tickets older than 3.44.2 are affected. The vulnerability is limited to the landb.php endpoint and applies to the Open ISES:Tickets product.

The CVSS score for this flaw is 5.1, indicating a medium severity. No exploit probability data is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated to the ticketing system and must send a crafted POST request to landb.php. Once the victim loads the generated page, the injected JavaScript executes, which can compromise the victim’s session or exfiltrate sensitive data.