Description
A security flaw has been discovered in code-projects Concert Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file /ConcertTicketReservationSystem-master/process_search.php of the component Parameter Handler. Performing a manipulation of the argument searching results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-04-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Database Compromise
Action: Immediate Patch
AI Analysis

Impact

An attacker can manipulate the search parameter in the file process_search.php of the Concert Ticket Reservation System, causing unsanitized input to be inserted into a SQL query. This flaw allows execution of arbitrary SQL statements against the underlying database, which can lead to reading, modifying, or deleting ticketing data. The vulnerability is a classic example of SQL injection, classified under CWE-74 and CWE-89.

Affected Systems

The issue affects Concert Ticket Reservation System version 1.0 provided by code-projects. No other versions or components are listed as impacted. The vulnerability resides specifically in the Parameter Handler component responsible for processing search requests.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity, while the EPSS score is unavailable and the vulnerability is not included in the CISA KEV catalog. Because the attack can be performed remotely and a public exploit has been released, the likelihood of exploitation is significant. Administrators should treat this as a moderate to high risk and act promptly to mitigate potential compromise of ticket data.

Generated by OpenCVE AI on April 5, 2026 at 11:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor patch or updated release that addresses the SQL injection in process_search.php.
  • If no patch is available, modify the application to use prepared statements or parameterized queries for all database interactions.
  • Limit direct access to the process_search.php endpoint to trusted users or internal networks.
  • Continuously monitor database logs for unusual SQL activity and investigate suspicious queries.

Generated by OpenCVE AI on April 5, 2026 at 11:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects concert Ticket Reservation System
Vendors & Products Code-projects
Code-projects concert Ticket Reservation System

Mon, 06 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in code-projects Concert Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file /ConcertTicketReservationSystem-master/process_search.php of the component Parameter Handler. Performing a manipulation of the argument searching results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Title code-projects Concert Ticket Reservation System Parameter process_search.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Concert Ticket Reservation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T16:20:24.097Z

Reserved: 2026-04-04T13:44:17.824Z

Link: CVE-2026-5554

cve-icon Vulnrichment

Updated: 2026-04-06T16:20:07.449Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T10:16:18.517

Modified: 2026-04-24T18:14:34.620

Link: CVE-2026-5554

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:56:59Z

Weaknesses