Open ISES Project SQL Injection Vulnerability in city_graph.php

A SQL injection vulnerability has been identified in the Open ISES Project version 3.30A. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the p1 parameter. Exploitation involves sending GET requests to city_graph.php with crafted SQL payloads, which can be used to extract sensitive database information, including schema names and other data.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could lead to unauthorized data access or manipulation within the database.

Reproduction

To reproduce this vulnerability, send a GET request to city_graph.php with a crafted SQL payload in the p1 parameter. The injected SQL code will be executed by the database, allowing the attacker to extract sensitive information.