Executive brief
The Concert Ticket Reservation System, a web application for managing event bookings, contains a security flaw in its login page. An attacker can exploit this to bypass authentication or access the underlying database without a valid account. This could lead to the theft of customer information, unauthorized modification of ticket data, or disruption of the reservation service.
Technical details
A SQL injection vulnerability exists in code-projects Concert Ticket Reservation System 1.0 within the 'Email' parameter of the login.php component. The application fails to properly sanitize or validate user-supplied input before incorporating it into SQL queries. A remote, unauthenticated attacker can exploit this by sending specially crafted POST requests to manipulate database queries. This can result in unauthorized data retrieval, authentication bypass, or modification of database records. Public exploits, including proof-of-concept payloads for boolean-based, error-based, and time-based blind injection, have been disclosed.
Affected products
- code-projects Concert Ticket Reservation System 1.0
Timeline
- 2026-03-19: disclosed: Vulnerability details and PoC shared on GitHub by researcher.
- 2026-04-05: advisory: VulDB and NVD published advisory.