Reflected XSS in Open ISES Tickets

Detection Guidance

This vulnerability can be detected by testing the affected endpoint icons/buttons/landb.php for reflected cross-site scripting (XSS) by sending POST requests with crafted JavaScript payloads in the frm_name and frm_id parameters and observing if the payload is executed in the response.

For example, you can use curl commands to send POST requests with test payloads to check if the input is reflected unsanitized:

• curl -X POST -d "frm_name=<script>alert(1)</script>&frm_id=test" https://target-system/icons/buttons/landb.php -v
• curl -X POST -d "frm_name=test&frm_id=<script>alert(1)</script>" https://target-system/icons/buttons/landb.php -v

If the response contains the injected script tags and the JavaScript executes in a browser, the vulnerability is present.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-48218 is a reflected cross-site scripting (XSS) vulnerability found in Open ISES Tickets versions before 3.44.2, specifically in the file icons/buttons/landb.php.

Authenticated attackers can exploit this flaw by injecting arbitrary JavaScript code through unsanitized POST parameters named frm_name and frm_id.

The injected JavaScript payload is then executed in the victim's browser when the server response is rendered, due to the lack of proper input sanitization and neutralization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript code in the context of a victim's browser session.

Such execution can lead to theft of sensitive information, session hijacking, or performing actions on behalf of the victim within the affected application.

Since the vulnerability requires authentication, attackers must have some level of access, but the impact can still be significant within that scope.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Open ISES Tickets to version 3.44.2 or later, where this reflected XSS vulnerability has been fixed.

Until an upgrade can be applied, restrict access to the affected endpoint to trusted authenticated users only, and consider implementing web application firewall (WAF) rules to detect and block suspicious payloads in the frm_name and frm_id POST parameters.

Additionally, review and apply input validation and output encoding on the frm_name and frm_id parameters to prevent injection of arbitrary JavaScript.

Useful 0 Not Useful 0