CVE-2021-44866

HIGH

Online-Movie-Ticket-Booking-System 1.0 - SQL Injection via about.php id Parameter

Title source: llm

Description

An issue was discovered in Online-Movie-Ticket-Booking-System 1.0. The file about.php does not perform input validation on the 'id' paramter. An attacker can append SQL queries to the input to extract sensitive information from the database.

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/projectworldsofficial/Online-Movie-Ticket-Booking-System-in-php/issues/6

Scores

CVSS v3 7.5

EPSS 0.0030

EPSS Percentile 53.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-89

Status published

Products (1)

projectworlds/online_movie_ticket_booking_system 1.0

Published Feb 03, 2022

Tracked Since Feb 18, 2026