CVE-2018-25404: Open ISES Project SQLi Vulnerability

CVE-2018-25404 Overview

CVE-2018-25404 is a SQL injection vulnerability [CWE-89] in The Open ISES Project version 3.30A. The flaw resides in the add_facnote.php script, which fails to sanitize the ticket_id GET parameter before passing it to the backend database. Unauthenticated remote attackers can inject arbitrary SQL queries to extract database contents, including version metadata and stored records. The vulnerability requires no privileges or user interaction and is exploitable over the network.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the Open ISES backend database through a single crafted HTTP GET request, exposing sensitive stored data.

Affected Products

The Open ISES Project 3.30A
add_facnote.php endpoint accepting the ticket_id parameter
Deployments sourced from the OpenISES SourceForge distribution

Discovery Timeline

2026-05-29 - CVE-2018-25404 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25404

Vulnerability Analysis

The vulnerability is a classic in-band SQL injection in a PHP web application. The add_facnote.php script accepts a ticket_id value from the query string and concatenates it directly into a SQL statement without parameterization or input validation. An attacker appends SQL syntax such as UNION SELECT clauses to the parameter to alter query semantics and return arbitrary data from the database.

Because the endpoint does not enforce authentication, exploitation is possible against any reachable Open ISES 3.30A instance. The Exploit-DB entry #45645 documents a working proof of concept against this endpoint. Successful exploitation reveals data such as the database engine version, table contents, and any credentials or operational records stored by the application.

Root Cause

The root cause is improper neutralization of special elements in an SQL command [CWE-89]. The ticket_id parameter is interpolated into a query string rather than bound through a prepared statement, allowing attacker-controlled syntax to break out of the intended value context.

Attack Vector

The attack vector is a network-based HTTP GET request to add_facnote.php with a malicious ticket_id value. The attacker requires no credentials, no user interaction, and no prior access to the host. See the VulnCheck Advisory on Open-ISES and Exploit-DB #45645 for the published request structure.

No verified exploit code is reproduced here. Refer to the linked advisories for the technical payload used to enumerate database version strings and extract records.

Detection Methods for CVE-2018-25404

Indicators of Compromise

HTTP GET requests to /add_facnote.php containing SQL keywords such as UNION, SELECT, SLEEP, or -- inside the ticket_id parameter.
Web server access logs showing unusually long ticket_id values or URL-encoded SQL syntax (%20UNION%20, %27, 0x).
Database error messages or anomalous query latency originating from the Open ISES application user.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the ticket_id parameter for SQL metacharacters and known injection patterns.
Enable database query auditing to flag queries originating from add_facnote.php that include UNION, INFORMATION_SCHEMA, or version functions.
Correlate web server logs with database logs to identify single requests that trigger multi-statement or schema-enumeration queries.

Monitoring Recommendations

Alert on bursts of GET requests to add_facnote.php from a single source address.
Monitor for outbound data transfer spikes from the database host that follow requests to the vulnerable endpoint.
Track failed query events on the application's database account, which often increase during injection probing.

How to Mitigate CVE-2018-25404

Immediate Actions Required

Restrict network access to Open ISES 3.30A instances to trusted internal networks only.
Place the application behind a WAF with SQL injection signatures enabled in blocking mode.
Audit the database account used by Open ISES and revoke any privileges beyond what the application requires.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2018-25404. The Open ISES Project is distributed via SourceForge and the upstream homepage is OpenISES Project Homepage. Operators should review project activity and, in the absence of an official fix, modify add_facnote.php to use parameterized queries (PDO::prepare with bound parameters or mysqli_prepare) and cast ticket_id to an integer before use.

Workarounds

Replace direct SQL string concatenation in add_facnote.php with prepared statements that bind ticket_id as an integer.
Add server-side input validation that rejects any ticket_id value containing non-numeric characters.
If the application is not actively used, take it offline until the source code can be remediated.

bash

# Example Apache rewrite rule to block non-numeric ticket_id values
RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)ticket_id=([^&]*[^0-9&][^&]*) [NC]
RewriteRule ^add_facnote\.php$ - [F,L]