Product
Open ISES Tickets before version 3.44.2 is vulnerable to SQL injection via the tick_id POST parameter in ajax/reports.php, allowing an authenticated attacker to alter query semantics to read, modify, or destroy database contents.