{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ticket-booking-app-1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2025-28346"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ticket-Booking-App (1.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Code-projects"],"content_html":"\u003cp\u003eA time-based blind SQL injection vulnerability (CVE-2025-28346) exists in the Code-projects Ticket-Booking-App 1.0. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries by injecting malicious payloads into the 'email' parameter of the 'authenticate.php' endpoint. The exploit relies on the 'sleep()' function to introduce artificial delays, allowing an attacker to confirm the vulnerability and exfiltrate data from the underlying database.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for database enumeration, unauthorized data extraction, and potential impact on backend DBMS operations, depending on the privileges of the database service account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory environments for instances of Ticket-Booking-App 1.0.\u003c/li\u003e\n\u003cli\u003eImplement input validation and parameterized queries for the 'email' parameter in 'authenticate.php'.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous request patterns targeting 'authenticate.php' with 'sleep' or time-delay functions in query parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T03:03:41Z","date_published":"2026-10-24T03:03:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-28346/","summary":"Ticket-Booking-App 1.0 is vulnerable to a time-based blind SQL injection in the email parameter of the authenticate.php script, allowing remote attackers to infer database content via time-delay payloads.","title":"Ticket-Booking-App: Time-based blind SQL injection (CVE-2025-28346)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-28346/"}],"language":"en","title":"CraftedSignal Threat Feed - Ticket-Booking-App (1.0)","version":"https://jsonfeed.org/version/1.1"}