A SQL injection vulnerability was discovered in the setSync function of pmTicket’s add_project.php. By manipulating the conn_settings argument, an attacker can inject arbitrary SQL statements, potentially allowing data exfiltration, modification, or other database compromise. The flaw is a classic SQL injection issue (CWE‑74, CWE‑89) that can be exploited remotely without authentication.

The flaw exists in all releases of pmTicket Project‑Management‑Software up to commit 078fa56a782490c5059a0814f84df27984f4d7e2. Because the product follows a rolling release model, no specific version numbers are supplied, meaning every build that has not yet been patched could be vulnerable.

The CVSS score of 6.9 classifies the risk as moderate. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation data to date. The attack can be launched remotely by any user able to reach the add_project.php endpoint, so the risk remains significant until a patch is applied or mitigations are in place.