Which versions of PHP are affected by CVE-2026-5554?

Concert Ticket Reservation System 1.0 contains a critical SQL injection vulnerability in its search functionality that allows unauthenticated attackers to access, modify, or delete the entire…

Is there a public PoC exploit available for CVE-2026-5554?

Yes, a public proof-of-concept exploit is available for CVE-2026-5554. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5554?

Within 24 hours: Identify all Concert Ticket Reservation System 1.0 instances on your network and isolate them from public internet access or disable process_search.php if not essential. Within 7 days: Contact the vendor for emergency patch availability and interim security updates; implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'searching' parameter (e.g., blocking single quotes, SQL keywords). Within 30 days: Upgrade to a patched version once available from the vendor, or migrate to an alternative ticketing system; conduct database audit for unauthorized access or modifications.

PHP CVE-2026-5554

Q: What is the CVSS score of CVE-2026-5554?

CVE-2026-5554 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19056 MEDIUM

SQL Injection (CWE-89)

2026-04-05 VulDB

PHP SQLi Concert Ticket Reservation System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 09:30 euvd

EUVD-2026-19056

Analysis Generated

Apr 05, 2026 - 09:30 vuln.today

CVE Published

Apr 05, 2026 - 09:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in code-projects Concert Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file /ConcertTicketReservationSystem-master/process_search.php of the component Parameter Handler. Performing a manipulation of the argument searching results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in Concert Ticket Reservation System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the 'searching' parameter in process_search.php. Publicly available exploit code exists (GitHub), enabling immediate weaponization. CVSS 7.3 reflects network-accessible attack with no complexity barriers, though EPSS data unavailable. Not confirmed as actively exploited (no CISA KEV listing), but POC publication significantly lowers exploitation threshold for opportunistic attackers targeting exposed instances.

Technical ContextAI

This vulnerability stems from inadequate input sanitization in a PHP-based web application's search functionality. The affected component (process_search.php) fails to properly validate or parameterize the 'searching' parameter before incorporating it into SQL queries, enabling classic SQL injection attacks (CWE-89). Concert Ticket Reservation System 1.0 is an open-source PHP application available through code-projects.org, commonly deployed by small businesses or educational environments without robust security hardening. The CPE identifier (cpe:2.3:a:code-projects:concert_ticket_reservation_system:*:*:*:*:*:*:*:*) confirms this affects the code-projects vendor's product line. SQL injection remains a prevalent web application vulnerability class, often exploited through automated scanners or manual techniques once endpoints are identified.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects.org does not maintain a formal security advisory program for this legacy project. Organizations must implement compensating controls immediately: apply input validation using parameterized queries or prepared statements for all SQL operations in process_search.php, specifically sanitizing the 'searching' parameter using allowlisting and context-appropriate escaping. Reference implementations for PHP PDO prepared statements should replace current string concatenation patterns. As interim mitigation, deploy web application firewall rules blocking SQL metacharacters in search parameters, restrict database account privileges to minimum required permissions (removing DELETE/DROP capabilities), and implement query monitoring for injection patterns. Consider migrating to actively maintained ticketing platforms with established security support. Detailed vulnerability disclosure available at https://vuldb.com/vuln/355324 and exploit code at https://github.com/Wzl731/test/issues/4 for defensive analysis.