CVE-2026-35015: Open ISES Tickets XSS Vulnerability

CVE-2026-35015 Overview

CVE-2026-35015 is a reflected cross-site scripting (XSS) vulnerability in Open ISES Tickets versions prior to 3.44.2. The flaw resides in do_unit_mail.php, where the the_ticket GET parameter is passed unsanitized directly into a JavaScript variable assignment. Authenticated attackers can craft a malicious URL containing a JavaScript payload that executes in the victim's browser when visited. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, UI manipulation, and client-side attacks against Open ISES Tickets users.

Affected Products

• Open ISES Tickets versions prior to 3.44.2
• The vulnerable script is do_unit_mail.php reachable via the the_ticket GET parameter
• Fixed in Open ISES Tickets release v3.44.2

Discovery Timeline

• 2026-05-20 - CVE-2026-35015 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-35015

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the Open ISES Tickets application. The do_unit_mail.php script reads the the_ticket GET parameter and writes it directly into a JavaScript variable assignment without any output encoding or input sanitization. Because the value lands inside a JavaScript context rather than HTML, attackers can break out of the variable assignment and inject executable script. Successful exploitation requires the victim to be authenticated and to follow an attacker-supplied URL, satisfying the user-interaction requirement reflected in the CVSS vector.

Root Cause

The root cause is missing output encoding when user-controlled GET parameters are reflected into PHP-generated JavaScript and HTML contexts. The upstream commit notes that 69 reflected XSS issues were fixed across 22 files, indicating a systemic pattern of trusting $_GET and $_POST values during template rendering. For numeric fields the fix applies intval(), and for string fields the fix uses htmlspecialchars() with ENT_QUOTES and a UTF-8 charset.

Attack Vector

An attacker crafts a URL targeting do_unit_mail.php with a JavaScript payload in the the_ticket parameter and tricks an authenticated user into visiting it. The injected script executes under the victim's origin and session, enabling cookie theft, CSRF chaining, and modification of rendered ticket content.

// Patch excerpt from add.php — numeric parameter hardened with intval()
// Vulnerable:
<INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print $_POST['ticket_id'];?>' />
// Fixed:
<INPUT TYPE='hidden' NAME='ticket_id' VALUE='<?php print intval($_POST['ticket_id']);?>' />

// Patch excerpt from add_facnote.php — string parameter hardened with htmlspecialchars()
// Vulnerable:
<INPUT TYPE='hidden' NAME='frm_ticket_id' VALUE='<?php print $_GET['ticket_id']; ?>' />
// Fixed:
<INPUT TYPE='hidden' NAME='frm_ticket_id' VALUE='<?php print htmlspecialchars($_GET['ticket_id'], ENT_QUOTES, 'UTF-8'); ?>' />

Source: GitHub Commit ecfeb40

Detection Methods for CVE-2026-35015

Indicators of Compromise

• Inbound HTTP GET requests to do_unit_mail.php containing the_ticket= values with JavaScript keywords such as <script, onerror=, onload=, or javascript:.
• URL-encoded XSS payloads (%3Cscript%3E, %22%3E, %27%3B) in the the_ticket query string.
• Referer logs showing authenticated users redirected from external domains to do_unit_mail.php.

Detection Strategies

• Inspect web server access logs for anomalous query string lengths and metacharacters on do_unit_mail.php and other Open ISES Tickets endpoints.
• Deploy a Web Application Firewall (WAF) rule set such as OWASP CRS to flag reflected XSS signatures targeting the the_ticket parameter.
• Hunt for outbound browser requests from internal users to attacker-controlled domains shortly after Open ISES Tickets URLs are loaded.

Monitoring Recommendations

• Centralize web server and proxy logs and alert on query parameters containing HTML or JavaScript delimiters.
• Monitor authenticated user sessions for unusual API calls originating from the ticketing UI that may indicate hijacked browser context.
• Track URL clicks delivered through email and chat platforms that point to the ticketing application's do_unit_mail.php endpoint.

How to Mitigate CVE-2026-35015

Immediate Actions Required

• Upgrade Open ISES Tickets to version 3.44.2 or later, which addresses CVE-2026-35015 and 68 related reflected XSS issues.
• Restrict access to the Open ISES Tickets application to trusted networks or via VPN until patching is complete.
• Invalidate active sessions and rotate authentication cookies after upgrading to limit residual exposure.

Patch Information

The fix is published in Open ISES Tickets Release v3.44.2 and implemented by GitHub Commit ecfeb40. Numeric inputs are coerced with intval() and string inputs are encoded with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before reflection. Additional context is available in the VulnCheck Advisory on Reflected XSS.

Workarounds

• Deploy WAF rules that block requests to do_unit_mail.php containing HTML tags, JavaScript event handlers, or URL-encoded equivalents in the the_ticket parameter.
• Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
• Set HttpOnly and SameSite=Strict attributes on session cookies to reduce the impact of script execution within the application origin.

# Example ModSecurity rule to block reflected XSS payloads in the_ticket parameter
SecRule ARGS:the_ticket "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1003501,phase:2,deny,status:403,log,msg:'CVE-2026-35015 reflected XSS attempt on do_unit_mail.php'"

# Example response header hardening for the Open ISES Tickets vhost
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"
Header always set X-XSS-Protection "1; mode=block"
Header always edit Set-Cookie ^(.*)$ "$1; HttpOnly; Secure; SameSite=Strict"