CVE-2026-48234 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. It occurs in portal/ajax/list_requests.php where the 'sort' and 'dir' GET parameters are unsafely concatenated into the ORDER BY clause of a SQL query. Because these parameters are not sanitized, an authenticated attacker can alter the SQL query's logic, potentially leading to unauthorized reading, modification, or deletion of database data. The vulnerability has a CVSS 4.0 score of 7.1, reflecting a high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The vendor has not yet provided an official fix or advisory. The product is not a cloud service, so remediation depends on vendor patching or user updates.

Successful exploitation allows an authenticated attacker to manipulate SQL queries in the affected component, potentially leading to unauthorized disclosure, modification, or destruction of database contents. This can compromise the confidentiality, integrity, and availability of the application's data. The CVSS score of 7.1 indicates a high impact vulnerability with a network attack vector and low complexity, but requiring authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected functionality to trusted authenticated users only and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns targeting the 'sort' and 'dir' parameters. Avoid exposing the vulnerable endpoint to untrusted networks. Monitor vendor channels for updates and apply patches promptly once available.