Product
Ticket-Booking-App 1.0 is vulnerable to a time-based blind SQL injection in the email parameter of the authenticate.php script, allowing remote attackers to infer database content via time-delay payloads.