Movie Ticketing System
Monthly
Code-Projects Movie Ticketing System 1.0 exposes sensitive database information through an unprotected SQL backup file at /db/moviedb.sql, allowing remote unauthenticated attackers to download and read the entire database via simple HTTP request. The vulnerability requires user interaction (UI:P per CVSS4.0) and has a publicly available exploit demonstrating the disclosure technique, though the very low CVSS score of 2.1 reflects limited confidentiality impact in typical deployments.
SQL injection in Movie Ticketing System 1.0 allows remote attackers with low privileges to manipulate the backend database through the Date parameter of the /ticketConfirmation.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. The impact is rated low by CVSS, limiting the risk to data exposure or minor data tampering.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.
Code-Projects Movie Ticketing System 1.0 exposes sensitive database information through an unprotected SQL backup file at /db/moviedb.sql, allowing remote unauthenticated attackers to download and read the entire database via simple HTTP request. The vulnerability requires user interaction (UI:P per CVSS4.0) and has a publicly available exploit demonstrating the disclosure technique, though the very low CVSS score of 2.1 reflects limited confidentiality impact in typical deployments.
SQL injection in Movie Ticketing System 1.0 allows remote attackers with low privileges to manipulate the backend database through the Date parameter of the /ticketConfirmation.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. The impact is rated low by CVSS, limiting the risk to data exposure or minor data tampering.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.