Skip to content
Threat Feed
Subscribe
medium advisory

Ticket-Booking-App: Time-based blind SQL injection (CVE-2025-28346)

Ticket-Booking-App 1.0 is vulnerable to a time-based blind SQL injection in the email parameter of the authenticate.php script, allowing remote attackers to infer database content via time-delay payloads.

CVE search metadata

CVE search record: CVE-2025-28346. KEV: no. Product: Ticket-Booking-App (1.0). Brief: Ticket-Booking-App: Time-based blind SQL injection (CVE-2025-28346). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2025-28346/

Triage facts

Revision 1
Applicability
Ticket-Booking-App (1.0)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 24, 03:03 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B3Likely

A time-based blind SQL injection vulnerability (CVE-2025-28346) exists in the Code-projects Ticket-Booking-App 1.0. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries by injecting malicious payloads into the 'email' parameter of the 'authenticate.php' endpoint. The exploit relies on the 'sleep()' function to introduce artificial delays, allowing an attacker to confirm the vulnerability and exfiltrate data from the underlying database.

Impact

Successful exploitation allows for database enumeration, unauthorized data extraction, and potential impact on backend DBMS operations, depending on the privileges of the database service account.

Recommendation

  • Inventory environments for instances of Ticket-Booking-App 1.0.
  • Implement input validation and parameterized queries for the 'email' parameter in 'authenticate.php'.
  • Monitor web server access logs for anomalous request patterns targeting 'authenticate.php' with 'sleep' or time-delay functions in query parameters.

Immediate actions

Deploy the Sigma detection rule to monitor for exploitation attempts targeting the authenticate.php endpoint.

Detection Engineering 24h

Threat Hunt

Search web server logs for requests to authenticate.php where the email parameter contains sql keywords or time-delay functions.

T1190 high high confidence hunt now

Data: web_server_access_logs

Mitigations

Apply input sanitization and parameterize queries on the email field in the authenticate.php script.

immediate IT Operations

CVE-2025-28346

Detection coverage 1

Detects CVE-2025-28346 Exploitation - Time-Based Blind SQLi

medium

Detects attempts to exploit CVE-2025-28346 by searching for SQL sleep commands within the email parameter of authentication requests.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →