CVE-2026-48238 is a SQL injection vulnerability in Open ISES Tickets before version 3.44.2. The issue exists in ajax/mobile_main.php where the id GET parameter is unsafely concatenated into a SELECT statement's WHERE clause used for ticket-existence checks. This lack of input sanitization allows authenticated attackers to manipulate the SQL query, enabling unauthorized reading, modification, or deletion of database records. The vulnerability has a CVSS 4.0 score of 7.1, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated attacker to alter the semantics of SQL queries executed by the application, potentially leading to unauthorized disclosure, modification, or destruction of database contents. This compromises the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and consider implementing web application firewall (WAF) rules to detect and block suspicious SQL injection patterns targeting the id parameter. Avoid exposing the vulnerable functionality to untrusted networks.