Open ISES Project SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Open ISES Project version 3.30A. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the p1 parameter. The injection occurs via GET requests sent to the inc_types_graph.php file. Exploiting this vulnerability could lead to the extraction of sensitive database information, including schema names and other data.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to 'inc_types_graph.php' with a crafted SQL payload in the 'p1' parameter. The injected SQL code will be executed by the database, allowing access to sensitive information.