CVE-2025-41002

Critical

Published: 23/02/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in Infoticketing allows an unauthenticated attacker to retrieve, create, update, and delete database data by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'.

Risk Assessment

An attacker can fully compromise the database, leading to loss of confidentiality, integrity, and availability. This may result in data theft or destruction.

Recommendation

Apply vendor patches immediately and implement input validation and parameterized queries in the affected file.

Original NVD description (English source)

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'.