The vulnerability resides in the portal/ajax/list_requests.php script, where the sort and dir GET parameters are concatenated directly into the ORDER BY clause without sanitization. This allows an attacker who is authenticated to the application to control the query order and inject arbitrary SQL, potentially reading, modifying, or deleting database records, thereby compromising data confidentiality, integrity, and availability.

Open ISES Tickets application versions prior to 3.44.2 are affected. The issue is present in all installations using the unsecured portal/ajax/list_requests.php endpoint.

The CVSS score of 7.1 indicates a high severity flaw. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector requires authenticated access to the application; an attacker can supply crafted sort and dir values in the URL, resulting in an arbitrary SQL execution attack. Because no additional privileges are required beyond normal user authentication, the risk to organizations that rely on this product is significant if the affected version remains in use.