CVE-2026-48237 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. The issue occurs in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated directly into SQL SELECT and UPDATE statements without proper sanitization or parameterization. This allows authenticated users to manipulate SQL queries, potentially compromising the integrity and confidentiality of the database contents. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1, reflecting network attack vector, low attack complexity, and high impact on confidentiality.

An authenticated attacker can exploit this vulnerability to alter the semantics of SQL queries executed by the application. This can lead to unauthorized reading, modification, or destruction of database contents, impacting data confidentiality and integrity. The vulnerability does not require user interaction and has low complexity, increasing the risk of exploitation. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious activity involving the frm_ticket_id and frm_resp_id parameters. Avoid exposing the vulnerable interface to untrusted networks. Implement input validation and parameterized queries as a temporary mitigation if possible.