The vulnerability resides in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated directly into SQL WHERE clauses without any input sanitization. This allows an attacker to alter the semantics of SELECT, UPDATE or DELETE statements, enabling them to read sensitive data, modify existing records, or delete database contents. The weakness is a classic SQL injection flaw (CWE-89).

Open ISES Tickets versions earlier than 3.44.2 are affected. The vulnerability impacts the core ticket management functionality exposed by message.php in these releases.

The CVSS score of 7.1 indicates a high level of risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector requires an authenticated user to submit crafted POST requests, so the exposure is limited to legitimate users or compromised credentials rather than arbitrary remote users.