Ejosterberg

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm add str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile main.php where the id GET parameter is concatenated into the WHERE clause of a SELECT statement used as a ticket-existence sanity check without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick id and f tick id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

**Nome do Software Vulnerável e Versões Afetadas** Open ISES Tickets versões anteriores a 3.44.2 **Descrição** O software desativa a verificação de certificado TLS ao emitir solicitações HTTPS externas durante o fluxo de login móvel (RouteMate). Isso ocorre no arquivo 'rm/incs/mobile login.inc.php' ao definir a variável `CURLOPT SSL VERIFYPEER` como false e não definir `CURLOPT SSL VERIFYHOST`. Um invasor de rede posicionado entre o servidor e o endpoint remoto pode apresentar um certificado forjado para interceptar, monitorar ou modificar solicitações e respostas, incluindo dados de sessão ou chaves de API. **Recomendações** Atualizar para a versão 3.44.2.