Reflected XSS in Open ISES Tickets search.php

Executive Summary

CVE-2026-35016 is a reflected cross-site scripting (XSS) vulnerability found in Open ISES Tickets versions before 3.44.2. It occurs in the search.php file where the frm_query POST parameter is not properly sanitized. Authenticated attackers can inject arbitrary JavaScript code through this parameter, which then gets executed in the victim's browser when the malicious request is submitted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various impacts such as theft of session cookies, user impersonation, or performing actions on behalf of the victim. Since the attack requires authentication, it targets users with access to the system, potentially compromising sensitive information or user accounts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the search.php endpoint of Open ISES Tickets for reflected cross-site scripting (XSS) via the frm_query POST parameter.

A common approach is to send a crafted POST request with a JavaScript payload in the frm_query parameter and observe if the payload is reflected and executed in the response.

For example, using curl to test the vulnerability:

• curl -X POST -d "frm_query=<script>alert('XSS')</script>" https://target-site/search.php -b cookies.txt -c cookies.txt

Note that authentication is required, so you must include valid session cookies or credentials in the request.

If the response contains the injected script within the HTML input field's VALUE attribute and it executes in the browser, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Open ISES Tickets to version 3.44.2 or later, where this reflected XSS vulnerability has been fixed.

Until the upgrade can be applied, restrict access to the affected search.php functionality to trusted users only, as exploitation requires authentication.

Additionally, consider implementing web application firewall (WAF) rules to detect and block suspicious payloads in the frm_query POST parameter.

Educate users to be cautious of unexpected or suspicious links that might trigger the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the reflected cross-site scripting vulnerability in Open ISES Tickets affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0