Description
A weakness has been identified in code-projects Concert Ticket Reservation System 1.0. This affects an unknown part of the file /ConcertTicketReservationSystem-master/login.php of the component Parameter Handler. Executing a manipulation of the argument Email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-04-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

A vulnerability exists in the login.php component of code‑projects Concert Ticket Reservation System 1.0, allowing attackers to inject arbitrary SQL through the Email parameter. This SQL injection can lead to unauthorized access to, modification of, or destruction of database contents. The flaw may be exploited remotely, giving attackers potential to compromise application data integrity and confidentiality.

Affected Systems

The affected product is code‑projects Concert Ticket Reservation System version 1.0. The vulnerability resides in the login.php file within the Parameter Handler component, and can affect all installations of the 1.0 release that have not applied any mitigation.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. Exploitation is possible without authentication over the web interface, and the vulnerability has publicly available exploits. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. Attackers can craft malicious Email inputs to hijack database queries remotely. The lack of mitigation allows for potential data breaches and database corruption if not addressed promptly.

Generated by OpenCVE AI on April 5, 2026 at 11:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or upgrade to the latest version of the Concert Ticket Reservation System.
  • If a patch is not available, modify login.php to validate and sanitize the Email parameter, and replace the vulnerable query with prepared statements or parameterized queries.
  • Limit the privileges of the database user used by the application so it can only perform the necessary operations and cannot drop tables or drive arbitrary queries.
  • Enable logging of failed login attempts and monitor for suspicious activity.

Generated by OpenCVE AI on April 5, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 07:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects concert Ticket Reservation System
Vendors & Products Code-projects
Code-projects concert Ticket Reservation System

Sun, 05 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in code-projects Concert Ticket Reservation System 1.0. This affects an unknown part of the file /ConcertTicketReservationSystem-master/login.php of the component Parameter Handler. Executing a manipulation of the argument Email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title code-projects Concert Ticket Reservation System Parameter login.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Concert Ticket Reservation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-07T02:48:05.783Z

Reserved: 2026-04-04T13:44:21.341Z

Link: CVE-2026-5555

cve-icon Vulnrichment

Updated: 2026-04-07T02:48:00.184Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T10:16:19.307

Modified: 2026-04-24T18:14:34.620

Link: CVE-2026-5555

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:56:58Z

Weaknesses