PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48240 Open ISES CVE debrief

CVE-2026-48240 is a high-severity SQL injection affecting Open ISES Tickets before 3.44.2. The vulnerable code in ajax/statistics.php concatenates tick_id and f_tick_id POST values into WHERE clauses in statistics rollup SELECT queries without sanitization, allowing authenticated attackers to change query behavior and potentially read, modify, or destroy database contents. A fix is present in the 3.44.2 release and linked commit.

Vendor
Open ISES
Product
Tickets
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-07-23
Advisory published
2026-05-21
Advisory updated
2026-07-23

Who should care

Operators and maintainers of Open ISES Tickets, especially administrators of internet-facing deployments, application security teams, and anyone responsible for the backend database or custom integrations.

Technical summary

The issue is a CWE-89 SQL injection in ajax/statistics.php. Two POST parameters, tick_id and f_tick_id, are directly concatenated into WHERE clauses used by statistics rollup SELECT statements. Because the inputs are not sanitized or parameterized, an authenticated attacker can alter query semantics. The described impact includes unauthorized database reads and the possibility of data modification or destruction. The vulnerability is fixed in v3.44.2.

Defensive priority

High. The attack requires authentication but can affect the confidentiality and integrity of the application database.

Recommended defensive actions

  • Upgrade Open ISES Tickets to version 3.44.2 or later.
  • Verify that all deployed instances and any bundled images or containers have the patched code path.
  • Review application and database logs for unusual statistics-rollup queries or unexpected POST values targeting ajax/statistics.php.
  • If compromise is suspected, assess database integrity and rotate any credentials or secrets that may have been exposed.
  • Confirm the application database account uses least-privilege access and cannot perform unnecessary destructive actions.

Evidence notes

The CVE description states the vulnerable parameters and impact directly. The linked Git commit and the v3.44.2 release provide patch corroboration, while the NVD record cites VulnCheck as the disclosure source. The NVD item in the supplied corpus is marked vulnStatus Deferred, so the official database detail may lag the disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48240 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48240

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48240 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48240

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.