The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou…

The Open ISES Project version 3.30A contains a critical SQL injection vulnerability identified as CVE-2018-25398. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries through the frm_passwd parameter in main.php. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads. The vulnerability enables extraction of sensitive database information including usernames, database names, and version details. This represents a significant security risk as it requires no authentication and allows direct database access.