Ticket Reservation System CVE-2026-108937

Exploitation requires that the /database/medallion.sql file be deployed within the web-accessible document root and served as a static file by the web server (the default layout of this application, where the database bootstrap SQL ships alongside the PHP code). No authentication, user interaction, or special configuration is required per the CVSS vector (PR:N/UI:N/AC:L). The practical LIMITING factors are: the server must not be configured to deny access to .sql files (many hardened or production deployments block or relocate such files outside the web root), and the attacker must know or guess the path - which the public POC supplies. Impact is confined to information disclosure (schema/structure and any data embedded in the SQL dump); it does not by itself grant write access or code execution.

This is a high-CVSS-label-but-low-real-risk issue in practice. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but the only impact is low confidentiality (VC:L, with VI:N/VA:N), consistent with CWE-538 file/directory information exposure - exposure of a SQL file (/database/medallion.sql) rather than code execution or data modification. Exploitation status is 'publicly available exploit code exists' (POC on GitHub, reported by VulDB); there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The input CVSS 4.0 includes E:P (Proof-of-Concept exploit maturity), which aligns with the public POC but again does not indicate in-the-wild use. The practical risk is modest: the affected product (code-projects Online Ticket Reservation System 1.0) is a small open-source/student-grade PHP application with negligible enterprise deployment, so this is a low-priority, information-disclosure-only issue for the overwhelming majority of organizations. No SSVC decision data was provided in the input.

A remote, unauthenticated attacker requests the predictable path /database/medallion.sql directly from the web server and retrieves the application's SQL file, revealing database schema, table/column names, and potentially seeded credentials or structure. A public POC exists (GitHub, KaranParelkar), lowering the effort required. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed.