The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou…

The Open ISES Project version 3.30A contains a critical SQL injection vulnerability identified as CVE-2018-25402. The vulnerability exists in the inc_types_graph.php file and can be exploited through the p1 parameter. Unauthenticated attackers can execute arbitrary SQL queries by sending crafted GET requests to the vulnerable endpoint. The exploitation allows attackers to extract sensitive database information including schema names and other critical data. This vulnerability poses a significant risk as it requires no authentication and can lead to complete database compromise.