CVE-2018-25403: The Open ISES Project 3.30A SQL Injection via city_graph.php

Security readout for executives and security teams

Open ISES Project 3.30A has a high-severity SQL injection issue. An unauthenticated internet user may be able to manipulate database queries through the vulnerable web application and read sensitive database information. Sources do not show confirmed active exploitation, but a public exploit reference exists. Exposure appears limited to organizations still running Open ISES Project 3.30A, especially if the application is reachable from the internet or untrusted networks. The provided sources do not quantify deployment prevalence or identify affected versions beyond 3.30A. Prioritize this for immediate exposure review if Open ISES is in use. Internet-facing deployments should be restricted quickly because unauthenticated database access risk can affect sensitive information, even though active exploitation is not confirmed in the provided sources. Mitigation focus: Check Open ISES and advisory sources for a confirmed fixed version or vendor guidance.; Remove internet exposure for Open ISES until remediation is confirmed.; Disable or restrict access to vulnerable application functions if they are not business-critical..

Prepared

Jun 1, 2026, 02:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.