The vulnerability in Open ISES Tickets prior to version 3.44.2 is a reflected cross-site scripting issue located in routes_i.php. It arises because the ticket_id GET parameter is directly embedded into HTML hidden input fields without proper input neutralization. Authenticated attackers can exploit this by crafting URLs containing JavaScript payloads that execute in the context of the victim's browser upon rendering the response. This can lead to script execution but requires user interaction and authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser session when they visit a maliciously crafted URL. This can lead to session hijacking, unauthorized actions, or other client-side impacts depending on the injected script. However, the attack requires the victim to be authenticated and to interact with the malicious link. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs containing ticket_id parameters and restrict access to trusted users. Monitoring for suspicious activity related to ticket_id parameters may help detect exploitation attempts. Avoid clicking on untrusted links that reference the affected application. Once a vendor patch or update is released, apply it promptly.