PT-2026-21508 · Unknown · Infoticketing
CVE-2025-41002
·
Publicado
2026-02-23
·
Atualizado
2026-02-23
CVSS v4.0
9.3
Crítica
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Infoticketing (affected versions not specified)
Description
A SQL injection issue exists in Infoticketing. An unauthenticated attacker can retrieve, create, update, and delete the database. This is achieved by sending a POST request utilizing the
code parameter within the '/components/cart/cartApplyDiscount.php' API endpoint.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Infoticketing