Medium severity5.9NVD Advisory· Published May 21, 2026· Updated May 21, 2026
CVE-2026-48248
CVE-2026-48248
Description
Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for outbound HTTPS requests issued during the login/authentication flow. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Open ISES Tickets before 3.44.2 disables TLS certificate verification during login, allowing MITM attacks.
Vulnerability
Description
Open ISES Tickets prior to version 3.44.2 contains a vulnerability in the file incs/login.inc.php where the PHP cURL option CURLOPT_SSL_VERIFYPEER is explicitly set to false, and CURLOPT_SSL_VERIFYHOST is not set, thereby disabling TLS certificate verification for outbound HTTPS requests made during the login/authentication flow [3]. This means the application does not validate the authenticity of the remote server's TLS certificate when establishing secure connections.
Exploitation
An attacker who is positioned on the network path between the Open ISES Tickets server and the remote endpoint (e.g., an authentication API) can present a forged certificate to intercept the HTTPS connection. Since certificate verification is disabled, the server will accept the fraudulent certificate, allowing the attacker to perform a man-in-the-middle attack [2]. The attacker can monitor, intercept, or modify the request and response data in transit.
Impact
Successful exploitation enables the attacker to capture sensitive information transmitted during the login flow, including API keys, session tokens, or any other data exchanged over the compromised HTTPS connection. This could lead to unauthorized access, account takeover, or further compromise of the system.
Mitigation
The vulnerability is fixed in Open ISES Tickets version 3.44.2, released as part of a critical security update that patches 88 vulnerabilities, including four SSL certificate validation issues [2]. Users are strongly advised to upgrade immediately. For Docker deployments, run docker compose pull && docker compose up -d; for traditional installs, download the zip and extract over the existing installation, then run the installer in upgrade mode [2].
References
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
1ecfeb406a016Security: Fix 69 reflected XSS vulnerabilities across 22 files
29 files changed · +89 −89
add_facnote.php+1 −1 modified@@ -137,7 +137,7 @@ function validate () { <TD class='td_data'><TEXTAREA NAME='frm_notes' tabindex=4 COLS=60 ROWS = 3><?php print $notes;?></TEXTAREA></TD> </TR> </TABLE> - <INPUT TYPE = 'hidden' NAME = 'frm_ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>' /> + <INPUT TYPE = 'hidden' NAME = 'frm_ticket_id' VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' /> <INPUT TYPE = 'hidden' NAME = 'frm_existing' VALUE='<?php print $existing;?>' /> </FORM> </DIV>
add_nm.php+2 −2 modified@@ -344,7 +344,7 @@ function do_notify() { var theAddresses = '<?php print implode("|", array_unique($addrs));?>'; // drop dupes var theText= "TICKET - New: "; - var theId = '<?php print $_POST['ticket_id'];?>'; + var theId = '<?php print intval($_POST['ticket_id']);?>'; // mail_it ($to_str, $text, $theId, $text_sel=1;, $txt_only = FALSE) @@ -423,7 +423,7 @@ function do_notify() { // dummy </FORM> <FORM NAME='to_routes' METHOD='get' ACTION='routes.php'> - <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_POST['ticket_id'];?>' /> + <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print intval($_POST['ticket_id']);?>' /> <INPUT TYPE='submit' VALUE='Routes' /></CENTER> </FORM> <?php
add_note.php+1 −1 modified@@ -103,7 +103,7 @@ function set_signal(inval) { <B>Apply to</B> : Description » <INPUT TYPE = 'radio' NAME='frm_add_to' value='0' CHECKED /> <?php print $disposition;?> » <INPUT TYPE = 'radio' NAME='frm_add_to' value='1' /> - <INPUT TYPE = 'hidden' NAME = 'frm_ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>' /> + <INPUT TYPE = 'hidden' NAME = 'frm_ticket_id' VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' /> </FORM> </DIV> </DIV>
add.php+1 −1 modified@@ -653,7 +653,7 @@ function updt_ticket($id) { /* 1/25/09 */ <SPAN id='sub_but' class='plain text' style='float: none;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='document.to_main.submit();'>Main</SPAN><BR /> <BR /> <FORM NAME='to_routes' METHOD='get' ACTION='<?php print $_SESSION['routesfile'];?>'> - <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_POST['ticket_id'];?>' /> + <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print intval($_POST['ticket_id']);?>' /> </FORM> <SPAN id='sub_but' class='plain text' style='float: none;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='document.to_routes.submit();'>Routes</SPAN> </CENTER>
circle.php+1 −1 modified@@ -1342,7 +1342,7 @@ function toggle(the_value) { <BODY onload = 'document.dummy.submit();'> <FORM NAME='dummy' METHOD = 'post' ACTION = '<?php echo basename(__FILE__);?>'> <INPUT TYPE = 'hidden' NAME = '_func' VALUE = 'r' /> -<INPUT TYPE = 'hidden' NAME = 'id' VALUE = '<?php echo $_POST['frm_id'];?>' /> +<INPUT TYPE = 'hidden' NAME = 'id' VALUE = '<?php echo intval($_POST['frm_id']);?>' /> </FORM></BODY></HTML> <?php
db_loader.php+6 −6 modified@@ -633,12 +633,12 @@ function confirm_delete() { </DIV> </DIV> - <INPUT name='ticketshost' type='hidden' VALUE='<?php print $_POST['ticketshost'];?>' /> - <INPUT name='ticketsdb' type='hidden' VALUE='<?php print $_POST['ticketsdb'];?>' /> - <INPUT name='ticketsuser' type='hidden' VALUE='<?php print $_POST['ticketsuser'];?>' /> - <INPUT name='ticketspassword' type='hidden' VALUE='<?php print $_POST['ticketspassword'];?>' /> - <INPUT name='ticketsprefix' type='hidden' VALUE='<?php print $_POST['ticketsprefix'];?>' /> - <INPUT name='db_schema' type='hidden' VALUE='<?php print $_POST['db_schema'];?>' /> + <INPUT name='ticketshost' type='hidden' VALUE='<?php print htmlspecialchars($_POST['ticketshost'], ENT_QUOTES, 'UTF-8');?>' /> + <INPUT name='ticketsdb' type='hidden' VALUE='<?php print htmlspecialchars($_POST['ticketsdb'], ENT_QUOTES, 'UTF-8');?>' /> + <INPUT name='ticketsuser' type='hidden' VALUE='<?php print htmlspecialchars($_POST['ticketsuser'], ENT_QUOTES, 'UTF-8');?>' /> + <INPUT name='ticketspassword' type='hidden' VALUE='<?php print htmlspecialchars($_POST['ticketspassword'], ENT_QUOTES, 'UTF-8');?>' /> + <INPUT name='ticketsprefix' type='hidden' VALUE='<?php print htmlspecialchars($_POST['ticketsprefix'], ENT_QUOTES, 'UTF-8');?>' /> + <INPUT name='db_schema' type='hidden' VALUE='<?php print htmlspecialchars($_POST['db_schema'], ENT_QUOTES, 'UTF-8');?>' /> <INPUT name='page_background' type='hidden' VALUE='<?php print $page_background;?>' /> <INPUT name='normal_text' type='hidden' VALUE='<?php print $normal_text;?>' /> <INPUT name='form_input_background' type='hidden' VALUE='<?php print $form_input_background;?>' />
delete_module.php+7 −7 modified@@ -63,15 +63,15 @@ function mod_table_exists($tablename) { //check if mysql table exists, if it's <TR><TH class='heading'>Module Deletion - Confirmation</TH></TR> <TR><TD> </TD></TR> <TR><TD> </TD></TR> - <FORM NAME="delete_2" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> - <TR><TD style='font-size: 14px; font-weight: bold; background-color: #AEAEAE; text-align: center;'>Selected Module: <?php print $_POST['module_choice'];?></TD></TR> + <FORM NAME="delete_2" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>" method="post"> + <TR><TD style='font-size: 14px; font-weight: bold; background-color: #AEAEAE; text-align: center;'>Selected Module: <?php print htmlspecialchars($_POST['module_choice'], ENT_QUOTES, 'UTF-8');?></TD></TR> <TR><TD> </TD></TR> <TR><TD> </TD></TR> <TR><TD> </TD></TR> <TR><TD CLASS="td_label">Click Submit to confirm module deletion or Cancel to abort</TD></TR> <TR><TD> </TD></TR> <TR><TD> </TD></TR> - <INPUT TYPE='hidden' NAME='confirmation' VALUE='<?php print $_POST['module_choice'];?>'> + <INPUT TYPE='hidden' NAME='confirmation' VALUE='<?php print htmlspecialchars($_POST['module_choice'], ENT_QUOTES, 'UTF-8');?>'> <INPUT TYPE='hidden' NAME='flag' VALUE='Confirmation Received'> <TR><TD ALIGN="center"><INPUT TYPE="button" VALUE="Cancel" onClick="window.location.href='config.php'" > <input type="submit" name="submit" value="Submit" /></TD></TR> </FORM></TABLE> @@ -102,8 +102,8 @@ function rmdir_recurse($path) { ?> <DIV style='background-color:#CECECE; position: absolute; width: 60%; height: 60%; left: 20%; top: 10%; border:2px inset #FFF2BF; display: block; text-align: center'> - <BR /><BR /><BR /><BR /><?php print $_POST['flag'];?><BR /><BR /> - Deleting Tickets Module........<?php print $_POST['confirmation'];?><BR /><BR /> + <BR /><BR /><BR /><BR /><?php print htmlspecialchars($_POST['flag'], ENT_QUOTES, 'UTF-8');?><BR /><BR /> + Deleting Tickets Module........<?php print htmlspecialchars($_POST['confirmation'], ENT_QUOTES, 'UTF-8');?><BR /><BR /> Dropping Table........<?php print $table;?>........... <?php $query = "DROP table `{$GLOBALS['mysql_prefix']}" . $table ."`"; @@ -115,7 +115,7 @@ function rmdir_recurse($path) { } ?> - Removing Directory and files /modules/<?php print $_POST['confirmation'];?>.......... + Removing Directory and files /modules/<?php print htmlspecialchars($_POST['confirmation'], ENT_QUOTES, 'UTF-8');?>.......... <?php $directory = $tickets_dir . "/modules/" . $module_name; $rem_dir = rmdir_recurse($directory); @@ -162,7 +162,7 @@ function rmdir_recurse($path) { <DIV style='background-color:#CECECE; position: absolute; width: 40%; height: 20%; left: 5%; top: 10%; border:2px inset #FFF2BF; display: block'> <TABLE BORDER="0"> <TH COLSPAN="2">Delete a Tickets Module<BR /></TH> - <FORM NAME="delete_1" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> + <FORM NAME="delete_1" action="<?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>" method="post"> <TR CLASS="even"><TD CLASS="td_label">Module: </TD><TD><?php print $choice;?></TD> <TR CLASS="even"><TD COLSPAN="2" ALIGN="center"><input type="submit" name="submit" value="Submit" /></TD></TR> </FORM></TABLE>
do_unit_mail.php+1 −1 modified@@ -66,7 +66,7 @@ function subval_sort($a,$subkey) { } elseif((!(empty($_GET))) && (array_key_exists('the_ticket', $_GET)) && $_GET['the_ticket'] == "doselect") { // 10/23/12 $step = 1; } elseif((!(empty($_GET))) && (array_key_exists('the_ticket', $_GET)) && $_GET['the_ticket'] != "undefined" && $_GET['the_ticket'] != "doselect") { // 10/23/12 - $tik_id = $_GET['the_ticket']; + $tik_id = intval($_GET['the_ticket']); $step = (((integer) $_GET['the_ticket'])==0)? 0 : 2 ; } else { // dump(__LINE__);
icons/buttons/landb.php+3 −3 modified@@ -632,7 +632,7 @@ function waiter() { </SCRIPT> </HEAD> <BODY onLoad = "waiter();"> -<DIV align="center" ID = 'c_id'><BR /><BR /><BR/><H3>'<?php echo $_POST['frm_name'];?>' added</H3></DIV> +<DIV align="center" ID = 'c_id'><BR /><BR /><BR/><H3>'<?php echo htmlspecialchars($_POST['frm_name'], ENT_QUOTES, 'UTF-8');?>' added</H3></DIV> </BODY></HTML> <?php break; // end case "c" @@ -979,14 +979,14 @@ function toggle(the_value) { <SCRIPT> function waiter() { document.navform._func.value="r"; - document.navform.id.value=<?php echo $_POST['frm_id'];?> + document.navform.id.value=<?php echo intval($_POST['frm_id']);?> // fade("up_id;") setTimeout("document.navform.submit()",2000); } </SCRIPT> </HEAD> <BODY onLoad = "waiter();"> -<DIV align="center" ID = 'up_id'><BR /><BR /><BR/><H3>'<?php echo $_POST['frm_name'];?>' update complete</H3></DIV> +<DIV align="center" ID = 'up_id'><BR /><BR /><BR/><H3>'<?php echo htmlspecialchars($_POST['frm_name'], ENT_QUOTES, 'UTF-8');?>' update complete</H3></DIV> </BODY> </HTML> <?php
ics202.php+1 −1 modified@@ -219,7 +219,7 @@ function in_check( $name, $tabindex, $value, $ischecked) { // <input type=text echo template_ics ($item); // fills form with default $item entries ?> <input type = 'hidden' name = 'step' value = 2 /> -<input type = 'hidden' name = 'frm_add_str' value = '<?php echo $_POST['frm_add_str'];?>'/> +<input type = 'hidden' name = 'frm_add_str' value = '<?php echo htmlspecialchars($_POST['frm_add_str'], ENT_QUOTES, 'UTF-8');?>'/> </form> <script> function validate(our_form) { // ics form name check
ics205a.php+1 −1 modified@@ -178,7 +178,7 @@ function in_text( $name, $size, $tabindex, $data = "") { // <input type=text . echo template_205a ($item); // fills form with default $item entries ?> <input type = 'hidden' name = 'step' value = 2 /> -<input type = 'hidden' name = 'frm_add_str' value = '<?php echo $_POST['frm_add_str'];?>'/> +<input type = 'hidden' name = 'frm_add_str' value = '<?php echo htmlspecialchars($_POST['frm_add_str'], ENT_QUOTES, 'UTF-8');?>'/> </form> <script> function validate(our_form) { // ics form name check
ics205.php+1 −1 modified@@ -257,7 +257,7 @@ function in_text( $name, $size, $tabindex, $data = "") { // <input type=text . ?> <p style = 'margin-top:20px;'> <input type = 'hidden' name = 'step' value = 2 /> - <input type = 'hidden' name = 'frm_add_str' value = '<?php echo $_POST['frm_add_str'];?>'/> + <input type = 'hidden' name = 'frm_add_str' value = '<?php echo htmlspecialchars($_POST['frm_add_str'], ENT_QUOTES, 'UTF-8');?>'/> </form> </p>
ics213.php+1 −1 modified@@ -35,7 +35,7 @@ function template_213_t () { // table-only portion of page global $item; $out_str = "<TABLE DIR='LTR' BORDER=1 BORDERCOLOR='#000000' CELLPADDING=0 CELLSPACING=0 STYLE='width: 20.32cm; border:2px solid black; background-color: white;'>"; $out_str .= "\n<FORM NAME = 'ics213_form' METHOD = 'post' ACTION = '" . basename(__FILE__) . "' >\n"; - $out_str .= "\n<INPUT TYPE = 'hidden' NAME = 'frm_add_str' VALUE = '{$_POST['frm_add_str']}'/>\n"; + $out_str .= "\n<INPUT TYPE = 'hidden' NAME = 'frm_add_str' VALUE = '" . htmlspecialchars($_POST['frm_add_str'], ENT_QUOTES, 'UTF-8') . "'/>\n"; $out_str .= "<INPUT TYPE = 'hidden' NAME = 'step' VALUE = 2> <COL WIDTH=46*> <COL WIDTH=54*>
ics213rr.php+1 −1 modified@@ -378,7 +378,7 @@ function in_text( $name, $size, $data, $dis) { // <input type=text ... <SPAN ID='sub_but' class='plain text' style='float: none; width: 120px;; display: inline-block;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick="validate(this.form);"><SPAN STYLE='float: left;'><?php print get_text("Next");?></SPAN><IMG STYLE='float: right;' SRC='./images/submit_small.png' BORDER=0></SPAN><BR /> </div> <input type = 'hidden' name = 'step' value = 2 /> -<input type = 'hidden' name = 'frm_add_str' value = '<?php echo $_POST["frm_add_str"];?>'/> +<input type = 'hidden' name = 'frm_add_str' value = '<?php echo htmlspecialchars($_POST["frm_add_str"], ENT_QUOTES, 'UTF-8');?>'/> </form> <script> function validate(our_form) { // ics form name check
ics214.php+1 −1 modified@@ -214,7 +214,7 @@ function in_text( $name, $size, $tabindex, $data = "") { // <input type=text . echo template_ics ($item); // fills form with default $item entries ?> <input type = 'hidden' name = 'step' value = 2 /> -<input type = 'hidden' name = 'frm_add_str' value = '<?php echo $_POST['frm_add_str'];?>'/> +<input type = 'hidden' name = 'frm_add_str' value = '<?php echo htmlspecialchars($_POST['frm_add_str'], ENT_QUOTES, 'UTF-8');?>'/> </form> <script> function validate(our_form) { // ics form name check
incs/mail_form.php+1 −1 modified@@ -533,7 +533,7 @@ function subval_sort($a,$subkey) { LEFT JOIN `$GLOBALS[mysql_prefix]responder` `r` ON (`a`.`responder_id` = `r`.`id`) LEFT JOIN `$GLOBALS[mysql_prefix]un_status` `s` ON (`r`.`un_status_id` = `s`.`id`) LEFT JOIN `$GLOBALS[mysql_prefix]ticket` `t` ON (`a`.`ticket_id` = `t`.`id`) - WHERE `ticket_id` = {$_GET['ticket_id']} AND (LOCATE('@', `contact_via`) > 1 || (`smsg_id` IS NOT NULL AND `smsg_id` <> '')) + WHERE `ticket_id` = " . intval($_GET['ticket_id']) . " AND (LOCATE('@', `contact_via`) > 1 || (`smsg_id` IS NOT NULL AND `smsg_id` <> '')) AND ((`clear` IS NULL) OR (DATE_FORMAT(`clear`,'%y') = '00')) ORDER BY `name` ASC "; $tik_id = $_GET['ticket_id'];
landb.php+1 −1 modified@@ -771,7 +771,7 @@ function buildMap_c() { // 'create' version - 691 <INPUT TYPE='hidden' NAME = '_func' VALUE='cp' /> <INPUT TYPE='hidden' NAME = 'frm_line_status' VALUE='0' /> <INPUT TYPE='hidden' NAME = 'frm_line_cat_id' VALUE='0' /> - <INPUT TYPE='hidden' NAME = 'frm_line_type' VALUE='<?php echo $_POST['_type'];?>' /> + <INPUT TYPE='hidden' NAME = 'frm_line_type' VALUE='<?php echo htmlspecialchars($_POST['_type'], ENT_QUOTES, 'UTF-8');?>' /> <INPUT TYPE='hidden' NAME = 'frm_line_data' VALUE='' /> <INPUT TYPE='hidden' NAME = 'frm_filled' VALUE='0' /> <INPUT TYPE='hidden' NAME = 'frm_use_with_bm' VALUE='0' />
opena.php+2 −2 modified@@ -9,7 +9,7 @@ error_reporting(E_ALL); //10/1/08 require_once('./incs/functions.inc.php'); //7/28/10 -$call = (empty($_GET))? "": $_GET['frm_call']; // 10/1/08 +$call = (empty($_GET))? "": htmlspecialchars($_GET['frm_call'], ENT_QUOTES, 'UTF-8'); // 10/1/08 ?> @@ -60,7 +60,7 @@ function do_focus() { print "<BR /><H3>Test with aprs.fi succeeds!</H3>"; $temp = ($data->found ); // match count if($temp==0) { - print "<BR /><H3>No data for '{$_GET['frm_call']}'</H3><BR />"; + print "<BR /><H3>No data for '" . htmlspecialchars($_GET['frm_call'], ENT_QUOTES, 'UTF-8') . "'</H3><BR />"; } else { $entry = (object) $data->entries[0];
os_watch.php+7 −7 modified@@ -318,7 +318,7 @@ function do_tbl_footer() { </tr> </table> <input type = hidden name = "mode" value = 11 /> <!-- do_LOG_DB --> -<input type = hidden name = "ref" value = "<?php echo $_POST['ref'];?>" /> +<input type = hidden name = "ref" value = "<?php echo htmlspecialchars($_POST['ref'], ENT_QUOTES, 'UTF-8');?>" /> </form> </body> @@ -384,7 +384,7 @@ function set_signal(inval) { <form name='osw_form' method='post' action = '<?php echo basename(__FILE__) ;?>'> <input type = hidden name = "mode" value = "13" /> <!-- do_NOTE_DB --> -<input type = hidden name = "ref" value = "<?php echo $_POST['ref'];?>" /> +<input type = hidden name = "ref" value = "<?php echo htmlspecialchars($_POST['ref'], ENT_QUOTES, 'UTF-8');?>" /> <input type = hidden name = 'frm_type' value='' /> <textarea name='frm_text' cols=70 rows = 2 placeholder = "Enter note text"></textarea> <br /> @@ -434,9 +434,9 @@ function set_signal(inval) { ?> <BODY onload = "setTimeout(function(){ do_can(); }, 1500);"> <!-- 1/14/10 --> <form name = "osw_form" method = "post" action = "<?php echo basename(__FILE__); ?>"> -<input type = hidden name = "mode" value = "<?php echo $_POST['mode_orig'];?>" /> <!-- original entry --> -<input type = hidden name = "mode_orig" value = "<?php echo $_POST['mode_orig'];?>" /> -<input type = hidden name = "ref" value = "<?php echo $_POST['ref'];?>" /> +<input type = hidden name = "mode" value = "<?php echo htmlspecialchars($_POST['mode_orig'], ENT_QUOTES, 'UTF-8');?>" /> <!-- original entry --> +<input type = hidden name = "mode_orig" value = "<?php echo htmlspecialchars($_POST['mode_orig'], ENT_QUOTES, 'UTF-8');?>" /> +<input type = hidden name = "ref" value = "<?php echo htmlspecialchars($_POST['ref'], ENT_QUOTES, 'UTF-8');?>" /> </form> <center> @@ -546,7 +546,7 @@ function validate () { <form name = 'osw_form' method = post action = "<?php echo basename(__FILE__); ?>"> <input type = hidden name = "mode" value = 15 /> <!-- do_MAIL_SEND --> -<input type = hidden name = "ref" value = "<?php echo $_POST['ref'];?>" /> +<input type = hidden name = "ref" value = "<?php echo htmlspecialchars($_POST['ref'], ENT_QUOTES, 'UTF-8');?>" /> <center> <TABLE ALIGN='center' BORDER = 0 style = 'margin-top:20px;'> <TR CLASS='odd'><TH COLSPAN=2>Mail to: <?php print $row['handle']; ?></TH></TR> <!-- 7/2/10 --> @@ -625,7 +625,7 @@ function validate () { <CENTER><BR /><BR /><BR /><H3>Message sent - window closing</H3> <form name = 'osw_form' method = post action = "<?php echo basename(__FILE__); ?>"> <input type = hidden name = "mode" value = "" /> -<input type = hidden name = "ref" value = "<?php echo $_POST['ref'];?>" /> +<input type = hidden name = "ref" value = "<?php echo htmlspecialchars($_POST['ref'], ENT_QUOTES, 'UTF-8');?>" /> </form> <?php
patient_JF.php+4 −4 modified@@ -209,7 +209,7 @@ function do_lock(theForm) { // 8/10/08 function do_notify() { var theAddresses = '<?php print implode("|", array_unique($addrs));?>'; // drop dupes var theText= "TICKET - PATIENT: "; - var theId = '<?php print $_GET['ticket_id'];?>'; + var theId = '<?php print intval($_GET['ticket_id']);?>'; // mail_it ($to_str, $text, $ticket_id, $text_sel=1;, $txt_only = FALSE) var params = "frm_to="+ escape(theAddresses) + "&frm_text=" + escape(theText) + "&frm_ticket_id=" + escape(theId) + "&text_sel=1"; // ($to_str, $text, $ticket_id) 10/15/08 @@ -326,7 +326,7 @@ function do_notify() { // dump(stripslashes($row['description'])); ?> <FONT CLASS="header">Edit <?php print get_text("Patient");?> Record</FONT><BR /><BR /> - <FORM METHOD='post' NAME='patientEd' onSubmit='return validate(document.patientEd);' ACTION="patient.php?id=<?php print $_GET['id'];?>&ticket_id=<?php print $_GET['ticket_id'];?>&action=update"><TABLE BORDER="0"> + <FORM METHOD='post' NAME='patientEd' onSubmit='return validate(document.patientEd);' ACTION="patient.php?id=<?php print intval($_GET['id']);?>&ticket_id=<?php print intval($_GET['ticket_id']);?>&action=update"><TABLE BORDER="0"> <TR CLASS='even' > <TD><B>Patient Number: <font color='red' size='-1'>*</font></B></TD><TD><INPUT TYPE="text" NAME="frm_name" value="<?php print $row['name'];?>" size="32"></TD></TR> <TR CLASS='odd' VALIGN='top'><TD><B>Description:</B> <font color='red' size='-1'>*</font></TD><TD><TEXTAREA ROWS="8" COLS="45" NAME="frm_description" WRAP="virtual"><?php print $row['description'];?></TEXTAREA></TD></TR> @@ -346,7 +346,7 @@ function do_notify() { else { ?> <BR /><BR /><FONT CLASS="header">Add <?php print get_text("Patient");?> Record</FONT><BR /><BR /> - <FORM METHOD="post" NAME='patientAdd' onSubmit='return validate(document.patientAdd);' ACTION="patient.php?ticket_id=<?php print $_GET['ticket_id'];?>&action=add"><TABLE BORDER="0"> + <FORM METHOD="post" NAME='patientAdd' onSubmit='return validate(document.patientAdd);' ACTION="patient.php?ticket_id=<?php print intval($_GET['ticket_id']);?>&action=add"><TABLE BORDER="0"> <TR CLASS='even' > <TD><B>Patient Number:</B> <font color='red' size='-1'>*</font></TD><TD><INPUT TYPE="text" NAME="frm_name" value="" size="32"></TD></TR> <TR CLASS='odd' ><TD><B>Description: </B><font color='red' size='-1'>*</font></TD><TD><TEXTAREA ROWS="8" COLS="45" NAME="frm_description" WRAP="virtual"></TEXTAREA></TD></TR> <!-- 10/19/08 --> @@ -362,7 +362,7 @@ function do_notify() { } ?> <FORM NAME='can_Form' ACTION="main.php"> -<INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print $_GET['ticket_id'];?>"> +<INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print intval($_GET['ticket_id']);?>"> </FORM> </HTML> <?php
patient.php+3 −3 modified@@ -466,7 +466,7 @@ function do_reset (the_form) { $row = stripslashes_deep($result->fetch_assoc()); ?> <SPAN STYLE='margin-left:83px;'><FONT CLASS="header">Edit <?php print get_text('Patient');?> Record</FONT></SPAN><BR /><BR /> - <FORM METHOD='post' NAME='patientEd' onSubmit='return validate(document.patientEd);' ACTION="patient.php?id=<?php print $_GET['id'];?>&ticket_id=<?php print $_GET['ticket_id'];?>&action=update"><TABLE BORDER="0"> + <FORM METHOD='post' NAME='patientEd' onSubmit='return validate(document.patientEd);' ACTION="patient.php?id=<?php print intval($_GET['id']);?>&ticket_id=<?php print intval($_GET['ticket_id']);?>&action=update"><TABLE BORDER="0"> <TABLE BORDER="0"> <TR CLASS='even'> <TD CLASS='td_label text'> @@ -686,7 +686,7 @@ function do_reset (the_form) { $pulldown .= "<option value=\"{$row_fc['id']}\">" . $row_fc['name'] . "</option>\n"; } ?> - <FORM METHOD="post" NAME='patientAdd' onSubmit='return validate(document.patientAdd);' ACTION="patient.php?ticket_id=<?php print $_GET['ticket_id'];?>&action=add"> + <FORM METHOD="post" NAME='patientAdd' onSubmit='return validate(document.patientAdd);' ACTION="patient.php?ticket_id=<?php print intval($_GET['ticket_id']);?>&action=add"> <TABLE BORDER="0"> <TR CLASS='header'> <TD COLSPAN='99' ALIGN='center'> @@ -822,7 +822,7 @@ function do_reset (the_form) { } ?> <FORM NAME='can_Form' ACTION="main.php"> -<INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print $_GET['ticket_id'];?>"> +<INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print intval($_GET['ticket_id']);?>"> </FORM> <SCRIPT LANGUAGE="Javascript"> if (typeof window.innerWidth != 'undefined') {
patient_w.php+6 −6 modified@@ -338,7 +338,7 @@ function set_signal(inval) { $row = stripslashes_deep($result->fetch_assoc()); print "<FONT CLASS='header text_large'>Really delete " . $patient . " record '" . shorten($row['description'], 24) . "' ? </FONT><BR /><BR />"; ?> - <FORM METHOD='post' NAME='delfrm' ACTION='patient_w.php?action=delete&id=<?php print $_GET['id'];?>&ticket_id=<?php print $_GET['ticket_id'];?>&confirm=1'> + <FORM METHOD='post' NAME='delfrm' ACTION='patient_w.php?action=delete&id=<?php print intval($_GET['id']);?>&ticket_id=<?php print intval($_GET['ticket_id']);?>&confirm=1'> <SPAN ID='sub_but' CLASS='plain text' STYLE='width: 100px; float: none; display: inline-block;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='document.delfrm.submit();'><SPAN STYLE='float: left;'><?php print get_text('Yes');?></SPAN><IMG STYLE='float: right;' SRC='./images/submit_small.png' BORDER=0 /></SPAN> <SPAN ID='can_but' CLASS='plain text' STYLE='width: 100px; float: none; display: inline-block;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='window.close();'><SPAN STYLE='float: left;'><?php print get_text('Cancel');?></SPAN><IMG STYLE='float: right;' SRC='./images/cancel_small.png' BORDER=0 /></SPAN> </FORM> @@ -479,7 +479,7 @@ function set_signal(inval) { <SPAN ID='reset_but' class='plain text' style='float: right; width: 100px;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='do_lock(document.patientEd); document.patientEd.reset();'><SPAN STYLE='float: left;'><?php print get_text("Reset");?></SPAN><IMG STYLE='float: right;' SRC='./images/restore_small.png' BORDER=0></SPAN> <SPAN ID='sub_but' class='plain text' style='float: right; width: 100px;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='document.patientEd.submit();'><SPAN STYLE='float: left;'><?php print get_text("Next");?></SPAN><IMG STYLE='float: right;' SRC='./images/submit_small.png' BORDER=0></SPAN> </DIV> - <FORM METHOD='post' NAME='patientEd' onSubmit='return validate(document.patientEd);' ACTION="<?php echo basename(__FILE__);?>?id=<?php print $_GET['id'];?>&ticket_id=<?php print $_GET['ticket_id'];?>&action=update"> + <FORM METHOD='post' NAME='patientEd' onSubmit='return validate(document.patientEd);' ACTION="<?php echo basename(__FILE__);?>?id=<?php print intval($_GET['id']);?>&ticket_id=<?php print intval($_GET['ticket_id']);?>&action=update"> <TABLE BORDER="0" STYLE='margin-left: 20px; position: relative; top: 70px;'> <TR CLASS='even' > <TD CLASS='td_label text'><?php print get_text("Patient ID");?>: <font color='red' size='-1'>*</font></TD> @@ -672,7 +672,7 @@ function to_edit(id) { </script> <FORM NAME = "list_form" METHOD = "get" ACTION = "<?php echo basename(__FILE__);?>"> - <INPUT TYPE="hidden" NAME = "ticket_id" VALUE = "<?php echo $_GET['ticket_id'];?>"> + <INPUT TYPE="hidden" NAME = "ticket_id" VALUE = "<?php echo intval($_GET['ticket_id']);?>"> <INPUT TYPE="hidden" NAME = "id" VALUE = ""> <INPUT TYPE="hidden" NAME = "action" VALUE = "edit"> </FORM> @@ -752,7 +752,7 @@ function to_edit(id) { <SPAN ID='reset_but' class='plain text' style='float: right; width: 100px;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='do_asof(document.patientAdd, false) reset();'><SPAN STYLE='float: left;'><?php print get_text("Reset");?></SPAN><IMG STYLE='float: right;' SRC='./images/restore_small.png' BORDER=0></SPAN> <SPAN ID='sub_but' class='plain text' style='float: right; width: 100px;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='validate(document.patientAdd);'><SPAN STYLE='float: left;'><?php print get_text("Next");?></SPAN><IMG STYLE='float: right;' SRC='./images/submit_small.png' BORDER=0></SPAN> </DIV> - <FORM METHOD="post" NAME='patientAdd' onSubmit='return validate(document.patientAdd);' ACTION="<?php echo basename(__FILE__);?>?ticket_id=<?php print $_GET['ticket_id'];?>&action=add"> + <FORM METHOD="post" NAME='patientAdd' onSubmit='return validate(document.patientAdd);' ACTION="<?php echo basename(__FILE__);?>?ticket_id=<?php print intval($_GET['ticket_id']);?>&action=add"> <TABLE BORDER="0" STYLE='margin-left: 20px; position: relative; top: 70px;'> <TR CLASS='even' > <TD CLASS='td_label text text'><?php print get_text("Patient ID");?>: <font color='red' size='-1'>*</font></TD> @@ -908,9 +908,9 @@ function init() { </BODY> <FORM NAME='next_Form' METHOD='get' ACTION='<?php echo basename(__FILE__); ?>'> <INPUT TYPE='hidden' NAME='action' VALUE='list' /> -<INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_GET['ticket_id'];?>' /> +<INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print intval($_GET['ticket_id']);?>' /> </FORM> <FORM NAME='can_Form' ACTION="main.php"> -<INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print $_GET['ticket_id'];?>"> +<INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print intval($_GET['ticket_id']);?>"> </FORM> </HTML>
routes_i.php+4 −4 modified@@ -235,19 +235,19 @@ function doReset() { <DIV ID="directions" STYLE="width: <?php print get_variable('map_width');?>"></DIV> </TD></TR></TABLE><!-- end outer --> <FORM NAME='can_Form' ACTION="main.php"> - <INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print $_GET['ticket_id'];?>"> - </FORM> + <INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print intval($_GET['ticket_id']);?>"> + </FORM> <FORM NAME='routes_Form' METHOD='post' ACTION="<?php print basename( __FILE__); ?>"> <INPUT TYPE='hidden' NAME='func' VALUE='do_db'> - <INPUT TYPE='hidden' NAME='frm_ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>'> + <INPUT TYPE='hidden' NAME='frm_ticket_id' VALUE='<?php print intval($_GET['ticket_id']); ?>'> <INPUT TYPE='hidden' NAME='frm_by_id' VALUE= "<?php print $_SESSION['user_id'];?>"> <INPUT TYPE='hidden' NAME='frm_id_str' VALUE= ""> <INPUT TYPE='hidden' NAME='frm_name_str' VALUE= ""> <INPUT TYPE='hidden' NAME='frm_status_id' VALUE= "1"> <INPUT TYPE='hidden' NAME='frm_comments' VALUE= "New"> </FORM> <FORM NAME='reLoad_Form' METHOD = 'get' ACTION="<?php print basename( __FILE__); ?>"> - <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>'> + <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print intval($_GET['ticket_id']); ?>'> </FORM> </BODY>
routes_nm.php+6 −6 modified@@ -844,7 +844,7 @@ function get_addr(){ // returns incident address </TD> </TR> </TABLE> - <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>' /> + <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' /> <INPUT TYPE='hidden' NAME='unit_id' VALUE='<?php print $unit_id; ?>' /> </FORM> @@ -893,15 +893,15 @@ function get_addr(){ // returns incident address </DIV> </DIV> <FORM NAME='can_Form' ACTION="main.php"> - <INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print $_GET['ticket_id'];?>"/> + <INPUT TYPE='hidden' NAME = 'id' VALUE = "<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8');?>"/> </FORM> <?php ?> <FORM NAME='routes_Form' METHOD='post' ACTION="<?php print $theAction;?>"> <INPUT TYPE='hidden' NAME='func' VALUE='do_db' /> - <INPUT TYPE='hidden' NAME='frm_ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>' /> + <INPUT TYPE='hidden' NAME='frm_ticket_id' VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' /> <INPUT TYPE='hidden' NAME='frm_by_id' VALUE= "<?php print $_SESSION['user_id'];?>" /> <INPUT TYPE='hidden' NAME='frm_id_str' VALUE= "" /> <INPUT TYPE='hidden' NAME='frm_name_str' VALUE= "" /> @@ -912,7 +912,7 @@ function get_addr(){ // returns incident address <INPUT TYPE='hidden' NAME='frm_allow_dirs' VALUE = <?php print $_SESSION['allow_dirs']; ?> /> <!-- 11/21/09 --> </FORM> <FORM NAME='reLoad_Form' METHOD = 'get' ACTION="<?php print basename( __FILE__); ?>"> - <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>' /> <!-- 10/25/08 --> + <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' /> <!-- 10/25/08 --> </FORM> <?php $user_level = is_super() ? 9999 : $_SESSION['user_id']; @@ -922,7 +922,7 @@ function get_addr(){ // returns incident address $al_groups = $_SESSION['user_groups']; ?> <FORM NAME='reLoad_Form' METHOD = 'get' ACTION="<?php print basename( __FILE__); ?>"> - <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>' /> <!-- 10/25/08 --> + <INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' /> <!-- 10/25/08 --> </FORM> </BODY> @@ -935,7 +935,7 @@ function get_addr(){ // returns incident address function do_notify() { var theAddresses = '<?php print implode("|", array_unique($addrs));?>'; // drop dupes var theText= "ATTENTION - New Ticket: "; - var theId = '<?php print $_GET['ticket_id'];?>'; + var theId = '<?php print intval($_GET['ticket_id']);?>'; // var params = "frm_to="+ escape(theAddresses) + "&frm_text=" + escape(theText) + "&frm_ticket_id=" + escape(theId); // ($to_str, $text, $ticket_id) 10/15/08 var params = "frm_to="+ theAddresses + "&frm_text=" + theText + "&frm_ticket_id=" + theId ; // ($to_str, $text, $ticket_id) 10/15/08
search.php+1 −1 modified@@ -349,7 +349,7 @@ function TrimString(sInString) { <TABLE CELLPADDING="2" BORDER="0" STYLE = 'margin-left:80px;'> <TR CLASS = "even"> <TD VALIGN="top" CLASS="td_label text">Search for: </TD> - <TD CLASS='td_data text'><INPUT TYPE="text" SIZE="40" MAXLENGTH="255" VALUE="<?php print $post_frm_query;?>" NAME="frm_query"></TD> + <TD CLASS='td_data text'><INPUT TYPE="text" SIZE="40" MAXLENGTH="255" VALUE="<?php print htmlspecialchars($post_frm_query, ENT_QUOTES, 'UTF-8');?>" NAME="frm_query"></TD> </TR> <TR CLASS = "odd"> <TD VALIGN="top" CLASS="td_label text">In: </TD>
single.php+2 −2 modified@@ -68,7 +68,7 @@ <?php if (!(is_guest())) { ?> - <SPAN id='edit_but' class='plain text' style='float: right; vertical-align: middle; display: inline-block; width: 100px;;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='window.opener.parent.frames["main"].location="edit.php?id=<?php print $_GET['ticket_id'];?>";'><SPAN STYLE='float: left;'><?php print get_text("Edit");?></SPAN><IMG STYLE='float: right;' SRC='./images/edit_small.png' BORDER=0></SPAN> + <SPAN id='edit_but' class='plain text' style='float: right; vertical-align: middle; display: inline-block; width: 100px;;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='window.opener.parent.frames["main"].location="edit.php?id=<?php print intval($_GET['ticket_id']);?>";'><SPAN STYLE='float: left;'><?php print get_text("Edit");?></SPAN><IMG STYLE='float: right;' SRC='./images/edit_small.png' BORDER=0></SPAN> <?php } ?> @@ -78,7 +78,7 @@ if (!(empty($row_ticket))) { // 4/30/10 print do_ticket_wm($row_ticket, $the_width, FALSE, FALSE); } else { - print "<CENTER><H3>No data for Ticket # {$_GET['ticket_id']} </H3>"; + print "<CENTER><H3>No data for Ticket # " . htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8') . " </H3>"; } ?> </DIV>
single_unit.php+1 −1 modified@@ -54,7 +54,7 @@ <?php if (!(is_guest())) { ?> - <SPAN id='edit_but' class='plain' style='float: right; vertical-align: middle; display: inline-block; width: 100px;;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='window.opener.parent.frames["main"].location="?func=responder&edit=true&id&id=<?php print $_GET['id'];?>";'><SPAN STYLE='float: left;'><?php print get_text("Edit");?></SPAN><IMG STYLE='float: right;' SRC='./images/edit_small.png' BORDER=0></SPAN> + <SPAN id='edit_but' class='plain' style='float: right; vertical-align: middle; display: inline-block; width: 100px;;' onMouseover='do_hover(this.id);' onMouseout='do_plain(this.id);' onClick='window.opener.parent.frames["main"].location="?func=responder&edit=true&id&id=<?php print intval($_GET['id']);?>";'><SPAN STYLE='float: left;'><?php print get_text("Edit");?></SPAN><IMG STYLE='float: right;' SRC='./images/edit_small.png' BORDER=0></SPAN> <?php } ?>
street_view.php+2 −2 modified@@ -37,8 +37,8 @@ function $() { // 1/19/09 var myPano; - var lat = <?php print $_GET['thelat'];?>; - var lng = <?php print $_GET['thelng'];?>; + var lat = <?php print floatval($_GET['thelat']);?>; + var lng = <?php print floatval($_GET['thelng']);?>; function do_the_view() { var the_loc = new GLatLng(lat,lng); panoramaOptions = { latlng:the_loc };
ticketsmdb_import.php+20 −20 modified@@ -150,16 +150,16 @@ function ck_frames() { </CENTER> </DIV> <FORM NAME='dodelete_Form' METHOD="post" ACTION = "ticketsmdb_import.php?mode=dodelete"> - <INPUT TYPE='hidden' NAME = 'mdbhost' VALUE="<?php print $_POST['mdbhost'];?>"/> - <INPUT TYPE='hidden' NAME = 'mdbdb' VALUE="<?php print $_POST['mdbdb'];?>"/> - <INPUT TYPE='hidden' NAME = 'mdbuser' VALUE="<?php print $_POST['mdbuser'];?>"/> - <INPUT TYPE='hidden' NAME = 'mdbpassword' VALUE="<?php print $_POST['mdbpassword'];?>" /> - <INPUT TYPE='hidden' NAME = 'mdbprefix' VALUE="<?php print $_POST['mdbprefix'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketshost' VALUE="<?php print $_POST['ticketshost'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketsdb' VALUE="<?php print $_POST['ticketsdb'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketsuser' VALUE="<?php print $_POST['ticketsuser'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketspassword' VALUE="<?php print $_POST['ticketspassword'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketsprefix' VALUE="<?php print $_POST['ticketsprefix'];?>" /> + <INPUT TYPE='hidden' NAME = 'mdbhost' VALUE="<?php print htmlspecialchars($_POST['mdbhost'], ENT_QUOTES, 'UTF-8');?>"/> + <INPUT TYPE='hidden' NAME = 'mdbdb' VALUE="<?php print htmlspecialchars($_POST['mdbdb'], ENT_QUOTES, 'UTF-8');?>"/> + <INPUT TYPE='hidden' NAME = 'mdbuser' VALUE="<?php print htmlspecialchars($_POST['mdbuser'], ENT_QUOTES, 'UTF-8');?>"/> + <INPUT TYPE='hidden' NAME = 'mdbpassword' VALUE="<?php print htmlspecialchars($_POST['mdbpassword'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'mdbprefix' VALUE="<?php print htmlspecialchars($_POST['mdbprefix'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketshost' VALUE="<?php print htmlspecialchars($_POST['ticketshost'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketsdb' VALUE="<?php print htmlspecialchars($_POST['ticketsdb'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketsuser' VALUE="<?php print htmlspecialchars($_POST['ticketsuser'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketspassword' VALUE="<?php print htmlspecialchars($_POST['ticketspassword'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketsprefix' VALUE="<?php print htmlspecialchars($_POST['ticketsprefix'], ENT_QUOTES, 'UTF-8');?>" /> </FORM> <FORM NAME='nodelete_Form' METHOD="post" ACTION = "config.php"></FORM> <?php @@ -319,16 +319,16 @@ function ck_frames() { </CENTER> </DIV> <FORM NAME='go_Form' METHOD="post" ACTION = "ticketsmdb_import.php?mode=go"> - <INPUT TYPE='hidden' NAME = 'mdbhost' VALUE="<?php print $_POST['mdbhost'];?>"/> - <INPUT TYPE='hidden' NAME = 'mdbdb' VALUE="<?php print $_POST['mdbdb'];?>"/> - <INPUT TYPE='hidden' NAME = 'mdbuser' VALUE="<?php print $_POST['mdbuser'];?>"/> - <INPUT TYPE='hidden' NAME = 'mdbpassword' VALUE="<?php print $_POST['mdbpassword'];?>" /> - <INPUT TYPE='hidden' NAME = 'mdbprefix' VALUE="<?php print $_POST['mdbprefix'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketshost' VALUE="<?php print $_POST['ticketshost'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketsdb' VALUE="<?php print $_POST['ticketsdb'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketsuser' VALUE="<?php print $_POST['ticketsuser'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketspassword' VALUE="<?php print $_POST['ticketspassword'];?>" /> - <INPUT TYPE='hidden' NAME = 'ticketsprefix' VALUE="<?php print $_POST['ticketsprefix'];?>" /> + <INPUT TYPE='hidden' NAME = 'mdbhost' VALUE="<?php print htmlspecialchars($_POST['mdbhost'], ENT_QUOTES, 'UTF-8');?>"/> + <INPUT TYPE='hidden' NAME = 'mdbdb' VALUE="<?php print htmlspecialchars($_POST['mdbdb'], ENT_QUOTES, 'UTF-8');?>"/> + <INPUT TYPE='hidden' NAME = 'mdbuser' VALUE="<?php print htmlspecialchars($_POST['mdbuser'], ENT_QUOTES, 'UTF-8');?>"/> + <INPUT TYPE='hidden' NAME = 'mdbpassword' VALUE="<?php print htmlspecialchars($_POST['mdbpassword'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'mdbprefix' VALUE="<?php print htmlspecialchars($_POST['mdbprefix'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketshost' VALUE="<?php print htmlspecialchars($_POST['ticketshost'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketsdb' VALUE="<?php print htmlspecialchars($_POST['ticketsdb'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketsuser' VALUE="<?php print htmlspecialchars($_POST['ticketsuser'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketspassword' VALUE="<?php print htmlspecialchars($_POST['ticketspassword'], ENT_QUOTES, 'UTF-8');?>" /> + <INPUT TYPE='hidden' NAME = 'ticketsprefix' VALUE="<?php print htmlspecialchars($_POST['ticketsprefix'], ENT_QUOTES, 'UTF-8');?>" /> </FORM> <?php break;
Vulnerability mechanics
Root cause
"The login script unconditionally disables TLS certificate verification for outbound HTTPS requests by setting CURLOPT_SSL_VERIFYPEER to false and omitting CURLOPT_SSL_VERIFYHOST."
Attack vector
An attacker with network access between the Open ISES Tickets server and the remote authentication endpoint can present a forged TLS certificate during the outbound HTTPS request made in the login flow [patch_id=1260398]. Because CURLOPT_SSL_VERIFYPEER is set to false and CURLOPT_SSL_VERIFYHOST is not set, cURL will accept any certificate without validation. The attacker can then intercept, decrypt, and modify the request and response, capturing any API keys, credentials, or session data transmitted in the clear over the attacker-controlled TLS tunnel.
Affected code
The vulnerability resides in incs/login.inc.php, where outbound HTTPS requests are made during the login/authentication flow [patch_id=1260398]. The code sets CURLOPT_SSL_VERIFYPEER to false and does not set CURLOPT_SSL_VERIFYHOST, disabling all TLS certificate validation for these requests.
What the fix does
The patch removes the line that sets CURLOPT_SSL_VERIFYPEER to false, restoring the default behavior where cURL validates the remote server's TLS certificate against a trusted CA store [patch_id=1260398]. It also adds an explicit CURLOPT_SSL_VERIFYHOST setting to ensure the hostname in the certificate matches the requested hostname. Together these changes prevent man-in-the-middle attacks by requiring proper certificate validation for all outbound HTTPS requests during the login flow.
Preconditions
- networkAttacker must be positioned on the network path between the Open ISES Tickets server and the remote authentication endpoint.
- inputAttacker must present a forged TLS certificate that will be accepted due to disabled verification.
Generated on May 21, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
38- Tenable Hexa AI automates remediation across attack surfacesHelp Net Security · May 21, 2026
- Riverbed introduces new Aternity tools for autonomous IT operationsHelp Net Security · May 21, 2026
- How a Webmail Log File Became a Root-Level BackdoorWordfence Blog · May 20, 2026
- Meet Rampart and Clarity, Microsoft’s new red team combo AI agentsCyberScoop · May 20, 2026
- Introducing RAMPART and Clarity: Open source tools to bring safety into Agent development workflowMicrosoft Security Blog · May 20, 2026
- Implement agentic AI in cybersecurity with Tenable Hexa AI: Reduce cyber risk at machine speedTenable Blog · May 20, 2026
- When your AI assistant has the keys to productionHelp Net Security · May 20, 2026
- Developer Workstations Are Now Part of the Software Supply ChainThe Hacker News · May 18, 2026
- Welcome to BlackFile: Inside a Vishing Extortion OperationMandiant Threat Intelligence · May 15, 2026
- When IT Support Calls: Dissecting a ModeloRAT Campaign from Teams to Domain CompromiseRapid7 Blog · May 13, 2026
- Canvas Owner Reaches Agreement With Cybercriminals After Ransomware AttackInfosecurity Magazine · May 13, 2026
- Most Remediation Programs Never Confirm the Fix Actually WorkedThe Hacker News · May 13, 2026
- State-sponsored actors, better known as the friends you don’t wantCisco Talos Intelligence · May 12, 2026
- Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas LeakThe Hacker News · May 12, 2026
- Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and ToolsUnit 42 · May 11, 2026
- Why Changing Passwords Doesn’t End an Active Directory BreachBleepingComputer · May 11, 2026
- 11th May – Threat Intelligence ReportCheck Point Research · May 11, 2026
- ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and MoreThe Hacker News · May 11, 2026
- Your Purple Team Isn't Purple — It's Just Red and Blue in the Same RoomThe Hacker News · May 11, 2026
- Zara Data Breach Impacts Nearly 200,000 CustomersInfosecurity Magazine · May 11, 2026
- Zara data breach exposed personal information of 197,000 peopleBleepingComputer · May 8, 2026
- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 27, 2026 to May 3, 2026)Wordfence Blog · May 7, 2026
- New Relic advances AI observability with new intelligence layerHelp Net Security · May 6, 2026
- Cybersecurity jobs available right now: May 5, 2026Help Net Security · May 5, 2026
- The 2026 World Cup scam economy is already running before the first whistleMalwarebytes Labs · May 4, 2026
- Download: Automating Pentest Delivery GuideHelp Net Security · May 1, 2026
- Vulnerability remediation: Match CVEs to asset owners in seconds with Tenable Hexa AITenable Blog · May 1, 2026
- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 20, 2026 to April 26, 2026)Wordfence Blog · Apr 30, 2026
- No Metrics Are Better Than Bad Metrics in the SOC, Says NCSCInfosecurity Magazine · Apr 28, 2026
- Could your choice of metrics be harming your SOC?NCSC UK · Apr 27, 2026
- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)Wordfence Blog · Apr 23, 2026
- Project Glasswing Proved AI Can Find the Bugs. Who's Going to Fix Them?The Hacker News · Apr 23, 2026
- Moving past bots vs. humansCloudflare Blog · Apr 21, 2026
- Building the agentic cloud: everything we launched during Agents Week 2026Cloudflare Blog · Apr 20, 2026
- The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment VariablesTrend Micro Research · Apr 20, 2026
- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 6, 2026 to April 12, 2026)Wordfence Blog · Apr 16, 2026
- Google Warns of New Threat Group Targeting BPOs and HelpdesksInfosecurity Magazine · Apr 9, 2026
- CrowdStrike Technical Risk Assessments Reveal Common Exposure PatternsCrowdStrike Blog