vendor:
Ticketly
by:
Javier Olmedo
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Ticketly
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: 2018-18923
CPE: a:abisoft:ticketly:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows & Ubuntu
2018
Ticketly 1.0 – Multiple SQL Injection
Ticketly 1.0 are affected by SQL Injection in multiple parameters and resources through POST. This allows a attacker to read and modify sensitive information from the database used by the application. Proof of concept (PoC) includes two POST requests, one generating an error 500 and the other generating a code 200 OK. Payloads include a boolean-based blind and an error-based payload.
Mitigation:
Input validation and sanitization should be used to prevent SQL injection attacks. Additionally, parameterized queries should be used to prevent SQL injection attacks.
