The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou…

The Open ISES Project 3.30A contains a critical SQL injection vulnerability (CVE-2018-25403) that allows unauthenticated attackers to execute arbitrary SQL queries. The vulnerability exists in the city_graph.php file through the p1 parameter. Attackers can exploit this by sending crafted GET requests with malicious SQL payloads to extract sensitive database information including schema names and other confidential data. This represents a high-severity vulnerability as it requires no authentication and can lead to complete database compromise.