Ejosterberg

**Name of the Vulnerable Software and Affected Versions** Open ISES Tickets versions prior to 3.44.2 **Description** A reflected cross-site scripting issue exists in the 'ics213.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value via the `frm add str` POST parameter, which is then placed directly into an HTML form hidden input value attribute. This allows a malicious payload to execute within the victim's browser when the response is rendered. **Recommendations** Update to version 3.44.2 or later. Avoid using the `frm add str` parameter in the 'ics213.php' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Open ISES Tickets versions prior to 3.44.2 **Description** An issue exists where the 'ajax/mobile main.php' endpoint fails to sanitize the `id` GET parameter before concatenating it into the WHERE clause of a SELECT statement used for a ticket-existence sanity check. This allows authenticated attackers to manipulate query semantics to read, modify, or destroy database contents via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Update to version 3.44.2 or later. Avoid using the `id` parameter in the 'ajax/mobile main.php' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Open ISES Tickets versions prior to 3.44.2 **Description** An issue exists in the incidents summary report where the `tick id` POST parameter is concatenated into the WHERE clause of SELECT statements without sanitization. This allows authenticated attackers to craft requests that alter query semantics to read, modify, or destroy database contents via the 'ajax/reports.php' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to version 3.44.2 or later. Avoid using the `tick id` parameter in the 'ajax/reports.php' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Open ISES Tickets versions prior to 3.44.2 **Description** An issue exists in the 'ajax/statistics.php' endpoint where the `tick id` and `f tick id` POST parameters are concatenated into WHERE clauses of SELECT statements in statistics rollup queries without proper sanitization. This allows authenticated attackers to manipulate query semantics to read, modify, or destroy database contents via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Update to version 3.44.2 or later. Avoid using the `tick id` and `f tick id` parameters in the 'ajax/statistics.php' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Open ISES Tickets versions prior to 3.44.2 **Description** The software disables TLS certificate verification when issuing outbound HTTPS requests during the mobile (RouteMate) login flow. This occurs in the file 'rm/incs/mobile login.inc.php' by setting the `CURLOPT SSL VERIFYPEER` variable to false and failing to set `CURLOPT SSL VERIFYHOST`. A network attacker positioned between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify requests and responses, including session-bearing data or API keys. **Recommendations** Update to version 3.44.2.