EUVD-2026-85749
GHSA-r7m3-w28j-vwx2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /ajax/add_project.php endpoint
-
ExploitInject SQL via conn_settings argument
-
ExecutionPayload concatenated in setSync query
-
ImpactDatabase read/write, data exfiltration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Requires network reachability to the pmTicket web application's /ajax/add_project.php endpoint and the ability to supply the conn_settings parameter to the setSync function. VulDB marks this PR:N (no authentication), but because add_project is a project-creation action, exploitation more plausibly requires an authenticated application session - verify against the source before treating it as pre-auth. Limiting factors: the product runs on a rolling-release model with no versioning and has essentially no production deployment base, and no vendor patch exists, so remediation requires manual code fixes or removing the affected endpoint from exposure. |
| Impact | This is a SQL injection (CWE-74/CWE-89) in the setSync function of /ajax/add_project.php via the conn_settings parameter of pmTicket Project-Management-Software. The sole scoring source is VulDB (cna@vuldb.com), which assigns CVSS 4.0 5.5 (Medium) with AV:N/AC:L/PR:N/UI:N and impact deliberately capped at VC:L/VI:L/VA:L - VulDB characteristically undersizes SQLi impact, whereas a classic injection typically yields full database read AND write, which would justify C:H/I:H. The E:P (Proof-of-Concept exists) exploit-maturity flag is corroborated by an asciinema demo recording (asciinema.org/a/1230576), so publicly available exploit code exists - but this is NOT the same as active exploitation. There is no EPSS score, no CISA KEV listing, and no evidence of in-the-wild use. The PR:N (unauthenticated) claim is questionable: adding a project is normally an authenticated action, and the description does not confirm the endpoint is reachable without a session - this conflict should be verified against the source. Net: the raw score is mid-range and a working PoC exists, but the product's near-zero real-world footprint (obscure OSS project-management app, no versioned releases, unresponsive vendor, no patch) makes this a low operational priority for the vast majority of defenders - relevant only to the handful of organizations actually running pmTicket. |
| Exploit ScenarioDerived | A remote attacker reaches the /ajax/add_project.php endpoint and submits a crafted conn_settings value that the setSync function concatenates into a SQL statement, injecting attacker-controlled SQL to read or manipulate the backend database. A public proof-of-concept demonstrating the attack exists (asciinema screencast referenced by VulDB). Given AV:N/AC:L, exploitation is low-complexity over the network, though it may require an authenticated session despite the PR:N claim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
SQL injection in the pmTicket project-management web application allows remote attackers to inject arbitrary SQL through the conn_settings argument processed by the setSync function in /ajax/add_project.php, giving at least read and modification access to database content (our assessment rates confidentiality and integrity impact as High, availability as None). Exploitation requires network reachability to that AJAX endpoint plus the ability to supply conn_settings, and publicly available exploit code exists (a proof-of-concept demonstration is referenced at asciinema.org); there is no KEV listing or other evidence of confirmed active exploitation. Access prerequisites are disputed: the published CVSS v4 vector states PR:N (no authentication), whereas our independent assessment assumes PR:L because add_project is a project-creation action that most plausibly runs behind an authenticated session, so treat pre-auth exploitability as unverified. The product is delivered on a rolling-release basis with no versioned builds, and the vendor did not respond to disclosure, so no patched release is available.
RemediationAI
No vendor-released patch identified at time of analysis: the vendor was contacted about this disclosure and did not respond, and the rolling-release model means there is no tagged fixed version to upgrade to. The primary remediation is therefore a manual code fix in /ajax/add_project.php - replace the dynamic SQL in setSync with parameterized/prepared statements and validate conn_settings against a strict allowlist of expected connection-setting keys and value formats, which removes the injection sink entirely with the only side effect being that malformed or unexpected conn_settings payloads are rejected. If the project-creation/sync functionality is not required, disable or remove the /ajax/add_project.php endpoint altogether (trade-off: project creation via that path stops working) or, less invasively, restrict it with an authenticated session check and network ACLs so only trusted administrative networks reach it (trade-off: it remains exploitable by any user who can reach it from an allowed range). Because authentication prerequisites are disputed, do not rely on 'it needs a login' as a control - enforce PR checks server-side and treat the endpoint as sensitive. Additional compensating measures: apply WAF SQL-injection signatures to the conn_settings parameter (bypassable with encoding tricks and prone to false positives), and reduce the application's database account to least privilege, ideally without DDL or cross-schema read rights, to cap what a successful injection can reach and exfiltrate. Monitor the VulDB advisory at https://vuldb.com/vuln/409005 and its CTI page https://vuldb.com/vuln/409005/cti for any change in vendor or patch status before assuming a fix will appear.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pmTicket is a PHP-based project-management application whose AJAX handlers execute server-side PHP that builds database queries. In this case the setSync routine in /ajax/add_project.php takes the conn_settings parameter - evidently a connection-settings value used when creating or syncing a project - and incorporates it into a SQL statement without adequate neutralization. The assigned CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e. injection) is the parent class that in this instance manifests concretely as SQL injection (CWE-89), consistent with the VulDB tags 'PHP' and 'SQLi'. Because the vulnerable sink is an unparameterized query reachable through a remote HTTP request, an attacker who can send a crafted conn_settings value can alter the query's logic and potentially read, modify, or delete rows depending on the privileges of the application's database account, and can also chain the injection toward data exfiltration or stored-content tampering. The public proof-of-concept recording at https://asciinema.org/a/1230576 (linked from the NVD references) corroborates that the injection path is demonstrable, and the VulDB entries (https://vuldb.com/vuln/409005 and the associated CTI page) carry the technical disclosure. No CPE identifiers were supplied, reflecting the project's commit-based, non-versioned distribution.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
SQLi over the network at low complexity typically grants full DB read/write (C:H/I:H); PR:L because a project-add endpoint most likely requires an authenticated session, not PR:N.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB