This exploit demonstrates an authentication bypass vulnerability in Ticket-Booking 1.4 via SQL injection in the login form. The crafted POST request bypasses authentication by manipulating the 'userid' parameter with a SQL payload, allowing unauthorized access to cancel booked seats.
Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:Ticket-Booking 1.4
No auth needed
Prerequisites:Access to the login page of the Ticket-Booking application · Valid session cookies (PHPSESSID)