Executive Summary

CVE-2026-48224 is a reflected cross-site scripting (XSS) vulnerability found in Open ISES Tickets versions before 3.44.2, specifically in the ics214.php file.

The vulnerability occurs because the frm_add_str POST parameter accepts input that is not properly sanitized and directly inserted into an HTML form's hidden input value attribute.

An authenticated attacker can exploit this by crafting a malicious request containing JavaScript code that will execute in the victim's browser when the response is rendered.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser.

Such an attack can lead to session hijacking, theft of sensitive information, or performing actions on behalf of the victim without their consent.

Since the attacker must be authenticated, the risk is somewhat limited to users with access, but it still poses a significant security threat.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the ics214.php endpoint for reflected cross-site scripting via the frm_add_str POST parameter. An authenticated request can be crafted to send a JavaScript payload in the frm_add_str parameter and observe if the payload is reflected and executed in the response.

A possible detection method is to use tools like curl or Burp Suite to send a POST request with a JavaScript payload in the frm_add_str parameter and check if the payload appears unsanitized in the HTML response.

• Example curl command to test the vulnerability (replace URL and authentication as needed):
• curl -X POST -d "frm_add_str=<script>alert('XSS')</script>" -b "cookie=your_auth_cookie" https://targetsite/ics214.php -v
• Check the response HTML for the injected script tag inside the hidden input value attribute.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update Open ISES Tickets to version 3.44.2 or later, where this vulnerability has been fixed.

Until the update can be applied, restrict access to the affected ics214.php page to trusted authenticated users only, and consider implementing web application firewall (WAF) rules to detect and block suspicious payloads in the frm_add_str POST parameter.

Useful 0 Not Useful 0