A direct SQL injection flaw exists in the ajax/reports.php component of Open ISES Tickets. The tick_id POST parameter is concatenated into the WHERE clause of SELECT statements without sanitization. Authenticated users can craft payloads that alter query semantics, allowing them to read sensitive data, modify records, or delete entries within the database.

Open ISES Tickets installations that use any version prior to 3.44.2 are affected. The issue is present in the open‑source release distributed by Open ISES and can be confirmed by reviewing the commit that introduced the vulnerable code. All users with access to the Ajax reporting endpoint can be impacted.

The CVSS score of 7.1 indicates a moderate to high risk. The exploit probability (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. Because authentication is required, the likely attack vector involves an attacker who has legitimate login credentials accessing the Ajax reports endpoint. Successful exploitation would compromise the confidentiality, integrity, and availability of the Ticketing application's database.