Open ISES Project SQL Injection Vulnerability in sever_graph.php

A SQL injection vulnerability has been identified in the Open ISES Project version 3.30A. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the p1 parameter. Exploitation involves sending crafted GET requests to sever_graph.php, which can lead to the extraction of sensitive database information, including schema names and other data.

Impact

Successful exploitation allows for arbitrary SQL execution, enabling attackers to manipulate database queries and potentially access or modify sensitive information.

Reproduction

The vulnerability can be reproduced by sending a GET request to 'sever_graph.php' with a crafted SQL payload in the 'p1' parameter. This can be done using a web browser or a tool like cURL or Postman. The injected SQL payload can be designed to extract database information, such as schema names, by exploiting the application's SQL query handling.