Open ISES Project SQL Injection Vulnerability in Nearby.php

A SQL injection vulnerability has been identified in the Open ISES Project version 3.30A. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads into the tick_lat and tick_lng parameters. Exploitation of this vulnerability can lead to the extraction of sensitive database information, including usernames, database names, and version details.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which can be used to manipulate the database or extract sensitive information.

Reproduction

The vulnerability can be reproduced by sending a GET request to nearby.php with crafted SQL payloads in the tick_lat and tick_lng parameters. The injected SQL is executed by the application, allowing the attacker to extract database information.