SQL Injection in pmTicket Project-Management-Software

A SQL injection vulnerability exists in the pmTicket Project-Management-Software, specifically affecting the 'setSync' function within the '/ajax/add_project.php' file. The vulnerability arises from improper sanitization of the 'conn_settings' input argument, allowing remote, unauthenticated attackers to inject and execute arbitrary SQL commands. This flaw affects all versions of the software up to commit hash 078fa56a782490c5059a0814f84df27984f4d7e2. As the software follows a rolling release model, there are no specific version numbers to track; users are advised to verify their current build against the latest available repository state. The vendor has remained unresponsive to disclosure attempts, necessitating proactive defensive measures by administrators hosting this application.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to gain unauthorized access to the underlying database. This can lead to the exfiltration of project-related sensitive data, manipulation of internal application state, or potential full administrative control over the application backend, depending on database permissions.

Recommendation

1. Deploy a Web Application Firewall (WAF) or equivalent monitoring solution to inspect and block HTTP requests to /ajax/add_project.php containing SQL injection payloads in the 'conn_settings' parameter.
2. Implement strict input validation and parameterization for all SQL queries within the application codebase.
3. Conduct an audit of the current application build against the latest commit hash in the upstream repository to ensure the patch is applied.
4. Ensure the database user account utilized by the pmTicket application is restricted to the minimum necessary privileges (Principle of Least Privilege) to minimize the impact of potential SQL injection exploitation.