This vulnerability is a classic SQL injection flaw in the tables.php module of Open ISES Tickets versions prior to 3.44.2. It allows an attacker with valid credentials to inject arbitrary SQL fragments through the POST parameters tablename, indexname and sortby. Because these parameters are directly concatenated into SQL identifiers, the attacker can manipulate SELECT, UPDATE and DELETE statements to read sensitive data, modify records, or delete database content. The weakness is consistent with CWE-89: Improper Neutralization of Special Elements used in a SQL Command.

The affected system is the Open ISES Tickets application. All installations running any pre‑3.44.2 version of the product are vulnerable. No specific sub‑versions were listed in the CNA data, but any application build before the 3.44.2 release should be considered at risk.

The CVSS score of 7.1 indicates a high severity. No EPSS data is available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access and the application constructs SQL identifiers directly from user input, an attacker who already has login credentials could readily craft requests to alter database operations. The lack of input sanitization allows the injection of malicious payloads; based on the description, it is inferred that this could lead to a bypass of database-level access controls.