CVE-2018-25404

Vulnerability

The Open ISES Project 3.30A contains an SQL injection vulnerability in the add_facnote.php endpoint. An unauthenticated attacker can inject arbitrary SQL commands through the ticket_id parameter (also referred to as tick_lat in proof-of-concept code). Affected version is 3.30A (specifically build 3.30A_050318 as noted in [1]). The vulnerability is classified as CWE-89 [4] and is reachable via GET requests without any authentication requirement.

Exploitation

An attacker sends a crafted GET request to /add_facnote.php with a malicious payload in the ticket_id parameter [1]. No authentication or prior access is needed; the vulnerability is exploitable remotely over the network [4]. The proof-of-concept demonstrates injection by appending SQL syntax to extract database content. Attackers can use standard SQL injection techniques to enumerate the database structure and retrieve data.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries against the database [4]. This results in confidentiality impact (high) as sensitive data such as database version information and other stored data can be extracted [4]. Integrity impact is low, and availability is not affected [4]. The attacker gains read access to the full database underpinning the application.

Mitigation

The vendor has not released a patched version specifically for this vulnerability. The download page on SourceForge [2] provides version 3.30A, and the official project site [3] lists v3.44.1 as the latest stable build, but it is unclear if this newer version addresses the SQL injection. No workaround is documented. Users should monitor the vendor homepage for updates or consider restricting access to add_facnote.php via web server rules. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.