CVE-2026-35014: Open ISES Tickets XSS Vulnerability

CVE-2026-35014 Overview

CVE-2026-35014 is a reflected cross-site scripting (XSS) vulnerability in Open ISES Tickets versions before 3.44.2. The flaw resides in routes_nm.php, where the ticket_id GET parameter is written directly into the VALUE attribute of a hidden HTML input without sanitization. Authenticated attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter. When a victim visits the crafted URL, the payload executes in their browser session. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, UI manipulation, and actions performed under the victim's identity within the Open ISES Tickets application.

Affected Products

• Open ISES Tickets versions prior to 3.44.2
• routes_nm.php endpoint accepting the ticket_id GET parameter
• Additional files patched in the same fix commit, including add.php and add_facnote.php

Discovery Timeline

• 2026-05-20 - CVE-2026-35014 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-35014

Vulnerability Analysis

The vulnerability is a reflected XSS issue caused by direct insertion of user-controlled input into an HTML attribute. The application reads ticket_id from the request and prints it into a hidden INPUT element's VALUE attribute using print $_POST['ticket_id'] or print $_GET['ticket_id']. Because the value is rendered without HTML encoding, an attacker can break out of the attribute context by injecting a single quote followed by additional HTML or event handler attributes. Authenticated access is required to reach the vulnerable route, which limits the attacker pool but does not prevent cross-user attacks against logged-in operators. Successful exploitation runs attacker-controlled script in the victim's browser under the application origin.

Root Cause

The root cause is missing output encoding on a request parameter reflected into an HTML attribute. The pre-patch code calls print $_POST['ticket_id'] (and print $_GET['ticket_id'] in related files) without applying either integer casting or HTML entity encoding. The same defect pattern occurred across 22 files in the codebase, accounting for 69 reflected XSS sinks fixed in a single commit.

Attack Vector

An attacker constructs a URL or form submission targeting routes_nm.php with a ticket_id value containing a quote-breakout payload such as ' onmouseover='alert(1). The attacker delivers the link to an authenticated user through phishing, chat, or an embedded link in another application. When the victim opens the URL, the server reflects the payload into the hidden input, the browser parses the injected attribute, and the script executes in the victim's session.

// Pre-patch (vulnerable) - add.php
<FORM NAME='to_routes' METHOD='get' ACTION='<?php print $_SESSION['routesfile'];?>'>
<INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_POST['ticket_id'];?>' />
</FORM>

// Post-patch - add.php (integer cast)
<INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print intval($_POST['ticket_id']);?>' />

// Post-patch - add_facnote.php (HTML entity encoding)
<INPUT TYPE='hidden' NAME='frm_ticket_id'
       VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' />

Source: GitHub Commit ecfeb40

Detection Methods for CVE-2026-35014

Indicators of Compromise

• Requests to routes_nm.php, add.php, or add_facnote.php where the ticket_id parameter contains characters such as <, >, ", ', or substrings like onmouseover=, onerror=, onclick=, or <script.
• HTTP referers from external domains pointing users into Open ISES Tickets URLs that include encoded JavaScript payloads in ticket_id.
• Browser console errors or unexpected outbound requests originating from the Open ISES Tickets application origin.

Detection Strategies

• Inspect web server access logs for non-numeric values in the ticket_id parameter, since the patched code expects an integer.
• Deploy a web application firewall rule that flags GET or POST parameters named ticket_id containing HTML or JavaScript metacharacters.
• Review authenticated user sessions for anomalous account actions correlated with visits to crafted routes_nm.php URLs.

Monitoring Recommendations

• Alert on URL patterns matching routes_nm.php?ticket_id= followed by URL-encoded angle brackets or quote characters.
• Track repeated requests from the same source IP that probe ticket_id with varying payloads, which suggests XSS fuzzing.
• Monitor outbound DOM events and CSP violation reports from clients using the application, if Content Security Policy reporting is configured.

How to Mitigate CVE-2026-35014

Immediate Actions Required

• Upgrade Open ISES Tickets to version 3.44.2 or later, which contains the fix from commit ecfeb40.
• Restrict access to the application to trusted networks while the patch is rolled out.
• Educate authenticated operators not to follow unsolicited links into the ticketing application.

Patch Information

The vendor addressed the issue in Open ISES Tickets release v3.44.2. The fix commit titled "Security: Fix 69 reflected XSS vulnerabilities across 22 files" applies intval() to numeric inputs such as ticket_id and htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to string inputs reflected into HTML attributes. See the GitHub Commit Record and the VulnCheck Advisory for Reflected XSS for technical details.

Workarounds

• Apply a reverse proxy or WAF rule that rejects requests where ticket_id is not strictly numeric.
• Add a Content Security Policy that disallows inline scripts and event handlers, reducing the impact of reflected payloads.
• Backport the patch by wrapping reflected ticket_id output with intval() or htmlspecialchars($value, ENT_QUOTES, 'UTF-8') in affected PHP files.

# Example WAF rule (ModSecurity) to block non-numeric ticket_id values
SecRule ARGS:ticket_id "!@rx ^[0-9]+$" \
    "id:1026350140,phase:2,deny,status:400,\
    msg:'CVE-2026-35014: Non-numeric ticket_id parameter blocked',\
    logdata:'ticket_id=%{ARGS.ticket_id}'"