Ticket-Booking-App (1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ticket-booking-app-1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 03:03:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTicket-Booking-App: Time-based blind SQL injection (CVE-2025-28346)https://feed.craftedsignal.io/briefs/2026-10-cve-2025-28346/Sat, 24 Oct 2026 03:03:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2025-28346/Ticket-Booking-App 1.0 is vulnerable to a time-based blind SQL injection in the email parameter of the authenticate.php script, allowing remote attackers to infer database content via time-delay payloads.A time-based blind SQL injection vulnerability (CVE-2025-28346) exists in the Code-projects Ticket-Booking-App 1.0. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries by injecting malicious payloads into the 'email' parameter of the 'authenticate.php' endpoint. The exploit relies on the 'sleep()' function to introduce artificial delays, allowing an attacker to confirm the vulnerability and exfiltrate data from the underlying database.

Impact

Successful exploitation allows for database enumeration, unauthorized data extraction, and potential impact on backend DBMS operations, depending on the privileges of the database service account.

Recommendation

  • Inventory environments for instances of Ticket-Booking-App 1.0.
  • Implement input validation and parameterized queries for the 'email' parameter in 'authenticate.php'.
  • Monitor web server access logs for anomalous request patterns targeting 'authenticate.php' with 'sleep' or time-delay functions in query parameters.
]]>mediumadvisory