CVE-2026-48235
SQL Injection in Open ISES Tickets GPS Tracker Integration
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL injection issue found in Open ISES Tickets versions before 3.44.2. It occurs in the file incs/remotes.inc.php where certain values such as latitude, longitude, callsign, mph, altitude, and timestamp are taken from external GPS tracking service responses (like InstaMapper and Google Latitude) and directly concatenated into SQL UPDATE and INSERT statements without proper sanitization.
Because these values are not sanitized, an attacker who can compromise or impersonate the remote GPS tracker endpoint can inject malicious SQL code. This allows them to manipulate the database tables related to responder location, tracks, and assignments.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized manipulation of location data and assignment information within the Open ISES Tickets system.
- An attacker could alter responder locations, potentially causing confusion or misdirection in emergency response.
- They could modify tracking data or assignments, leading to incorrect or fraudulent records.
- Since the vulnerability allows SQL injection, it could also be leveraged to perform other unauthorized database operations depending on the attacker's intent.