PT-2022-21219 · Unknown · Theme Park Ticketing System

Published 2022-06-15 · Updated 2022-06-24 · CVE-2022-32302

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Theme Park Ticketing System version 1.0

Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "edit ticket.php" endpoint.

Recommendations For Theme Park Ticketing System version 1.0, consider restricting access to the "edit ticket.php" endpoint until a patch is available. As a temporary workaround, avoid using the id parameter in the affected endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-32302

Affected Products

Theme Park Ticketing System

References · 5

• 🔥 https://yuque.com/docs/share/0255145d-8a60-4045-a5d2-fd82232e0faa · Exploit
• https://osv.dev/vulnerability/CVE-2022-32302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32302 · Security Note
• https://t.me/cvenotify/31657 · Telegram Post
• https://t.me/cibsecurity/44555 · Telegram Post