Open ISES Tickets versions prior to 3.44.2 suffer from a SQL injection flaw in db_loader.php. The script concatenates four POST parameters—ticketsdb, ticketshost, ticketsuser, ticketspassword—into mysqli connection arguments and forms dynamic SQL that is sent to an attacker‑controlled database. Because no input sanitization or prepared statements are used, an authenticated attacker can craft requests that alter query semantics, allowing read, write or delete operations against any configured database.

Affected deployments include all instances of Open ISES Tickets running a version older than 3.44.2. The vulnerability can be exercised by any user who has authenticated access to the web application, as the POST parameters are accepted through the public endpoint db_loader.php.

The CVSS score of 7.1 indicates a high severity level. The EPSS score is not available, and the issue is not listed in CISA KEV. The likely attack vector is an authenticated HTTP POST request to db_loader.php. Because the flaw requires validity of credentials, the risk is confined to accounts with database management privileges, but the impact on data confidentiality, integrity and availability is significant once exploited.