Open ISES Tickets contains a SQL injection flaw in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into SQL WHERE clauses without sanitization. This flaw allows an authenticated attacker to manipulate the query to read, modify, or delete database contents, thereby compromising confidentiality, integrity, and availability of the ticket data.

The vulnerability affects Open ISES Tickets versions prior to 3.44.2. All installations using these versions are potentially exposed.

The CVSS score of 7.1 indicates a high severity, but the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Exploitation requires valid user credentials; an attacker must be authenticated to the application to send crafted POST requests to the statistics endpoint. Once authenticated, the attacker can read or alter ticket data, or delete records, leading to significant data loss and potential regulatory impact.