CVE-2026-96751
Received Received - Intake

SQL Injection in pmTicket Project Management Software

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-96751
EUVD
EUVD-2026-85749

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pm_ticket project_management_software to 078fa56a782490c5059a0814f84df27984f4d7e2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated SQL injection in PmTicket Project-Management-Software. It exists in the setSync function of /ajax/add_project.php where manipulation of the conn_settings argument allows attackers to inject malicious SQL commands. The attack can be executed remotely without authentication.

Detection Guidance

The vulnerability is an unauthenticated SQL injection in PmTicket via the setSync function in /ajax/add_project.php. To detect it, inspect network traffic for suspicious requests targeting this endpoint with crafted conn_settings parameters. Check server logs for unusual SQL query patterns or errors. Use tools like sqlmap to test for SQL injection by sending payloads to the vulnerable parameter.

Impact Analysis

An attacker could exploit this to execute arbitrary SQL commands on the database. This may lead to unauthorized data access, modification, or deletion of sensitive information stored in the project management system. Attackers could also extract credentials or other confidential data.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this software may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately restrict access to the /ajax/add_project.php endpoint via firewall rules or web server configuration. Update PmTicket to the latest version if available. Implement input validation for the conn_settings parameter to prevent SQL injection. Monitor database queries for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96751. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart