D47 · SQL injection in `exit_ticket()`: `event_id`/`seat` interpolated unprepared into SELECT Mom2Be Security Audit

ביקורת אבטחה

חזרה ללוח

D47אומת בקודP0

SQL injection in `exit_ticket()`: `event_id`/`seat` interpolated unprepared into SELECT

B · unauth-POSTS3 · destructiveSECT1

תיקון

95%

מורכבות low

A seat parameter is placed into a database query unsafely, allowing SQL injection.

Seater.php:212

תיק מלא

ממצאים קשורים

D46 · `ajax_reassign_seat` has no capabilit…D13 · God-router: no nonce + no capability …D15 · `lcf_seater` engine table: no schema-…D39 · Stored XSS: buyer `full_name` unescap…D40 · Stored XSS in admin dashboards (guest…