CVE-2026-48234 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in portal/ajax/list_requests.php where the 'sort' and 'dir' parameters from GET requests are unsafely concatenated into the ORDER BY clause of a SQL query. Because these inputs are not sanitized, authenticated users can craft malicious requests that alter the SQL query's behavior, leading to unauthorized data access or modification. The vulnerability is rated with a CVSS 4.0 score of 7.1, indicating high severity. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

An authenticated attacker can exploit this vulnerability to manipulate SQL queries executed by the application, potentially allowing unauthorized reading, modification, or deletion of database contents. This could compromise the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted users only and consider implementing additional input validation or web application firewall rules to detect and block malicious input targeting the 'sort' and 'dir' parameters.