CVE-2026-48238 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. It occurs in ajax/mobile_main.php where the id parameter from a GET request is unsafely concatenated into a SQL SELECT statement used for ticket existence verification. This improper neutralization of special elements in the SQL command allows authenticated users to alter query semantics, enabling unauthorized reading, modification, or deletion of database data. The vulnerability is rated with a CVSS 4.0 score of 7.1 (high severity). No official remediation level or patch information is provided in the available data.

Exploitation of this vulnerability can lead to unauthorized access and manipulation of the application's database by authenticated users. Attackers may read sensitive data, modify records, or delete data, potentially compromising the integrity and confidentiality of ticketing system information. No known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, restricting access to authenticated users and validating or sanitizing input parameters at the application level may reduce risk.