Open ISES Tickets before version 3.44.2 contains a SQL injection flaw in the ajax/fullsit_incidents.php file where the offset GET parameter is concatenated directly into the LIMIT clause of a SELECT query without any sanitization. Because the query is executed in the context of an authenticated session, an attacker can craft requests that alter the semantics of the query and retrieve, modify, or delete data from the database. The weakness corresponds to CWE‑89 and compromises the confidentiality, integrity, and potentially the availability of the system if destructive operations are performed.

All installations of Open ISES Tickets running any version prior to 3.44.2 are affected. The vulnerability applies to the public‑facing AJAX endpoint provided by the application and requires the attacker to be an authenticated user within the system.

The CVSS base score of 7.1 indicates a high severity of the flaw. While the EPSS score is currently not available, the vulnerability is listed as not part of the CISA KEV catalog, suggesting no publicly known exploits at the time of this assessment. The likely attack vector involves a legitimate, authenticated web request to the affected endpoint; therefore the exploitation risk is significant but confined to users with legitimate credentials. Prompt remediation is recommended to mitigate the potential for data exfiltration and corruption.