The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou…

CVE-2018-25400 affects The Open ISES Project version 3.30A with an SQL injection vulnerability in the ajax/form_post.php endpoint. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries through the 'id' parameter. Attackers can send crafted GET requests to extract sensitive database information including schema names. The vulnerability enables complete database compromise without authentication requirements. Multiple proof-of-concept exploits are publicly available demonstrating the attack vector.