SQL Injection Vulnerability in Code-Projects Simple Ticket Booking

CVE-2024-7635

Summary

A significant SQL injection vulnerability exists within the Simple Ticket Booking application, specifically in the registration handler of the register_insert.php file. This flaw allows an attacker to manipulate input fields such as name, email, date of birth, password, gender, and phone number, leading to unauthorized database access and potential loss of sensitive information. The vulnerability is accessible remotely, enabling malicious actors to exploit it without physical access to the system. The exploit has been publicly disclosed, raising the urgency for affected users to assess and mitigate risks associated with this vulnerability.

References