Open ISES Tickets versions prior to 3.44.2 contain a SQL injection flaw in the ajax/sit_incidents.php script, where the GET parameter "offset" is concatenated directly into the LIMIT clause of a SELECT statement without any sanitization. Exploitation allows an authenticated attacker to alter the semantics of the database query, enabling read, write, or destructive operations against the application's database, thereby compromising confidentiality, integrity, and potentially availability.

The affected product is Open ISES Tickets. All installations running a version earlier than 3.44.2 are vulnerable. No specific minor version details are enumerated beyond the stated cutoff.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Exposure requires authentication to the application, limiting the attack surface to legitimate users; an authenticated user could execute arbitrary SQL via crafted requests to the vulnerable endpoint.