Executive brief
A security vulnerability exists in the Concert Ticket Reservation System, a web application used for managing event bookings. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information or disruption of the reservation service. This attack can be carried out remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in code-projects Concert Ticket Reservation System 1.0 within the 'searching' parameter of the /ConcertTicketReservationSystem-master/process_search.php file. The root cause is the failure to properly sanitize or validate user-supplied input before using it in a database query. A remote, unauthenticated attacker can exploit this by sending crafted POST requests containing SQL payloads (including boolean-based, time-based, and UNION-based techniques). Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of records. A public exploit (PoC) has been released, but no official patch is currently documented.
Affected products
- code-projects Concert Ticket Reservation System 1.0
Timeline
- 2026-03-19: disclosed: Initial discovery and issue report on GitHub
- 2026-04-05: advisory: NVD publication date