CVE-2026-48240 is a SQL injection vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue exists in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated directly into SQL SELECT statements without proper sanitization or parameterization. Authenticated attackers can exploit this flaw to alter the semantics of SQL queries, potentially leading to unauthorized access or modification of the underlying database. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated attacker to manipulate SQL queries in the statistics rollup functionality, enabling unauthorized reading, modification, or deletion of database data. This compromises data integrity and confidentiality within the affected Open ISES Tickets installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected ajax/statistics.php endpoint to trusted users only and monitor for suspicious activity related to POST parameters tick_id and f_tick_id. Avoid exposing this functionality to untrusted users.