CVE-2025-7886

Vulnerability

Overview CVE-2025-7886 describes a critical SQL injection vulnerability in pmTicket Project-Management-Software up to commit 2ef379da2075f4761a2c9029cf91d073474e7486. The flaw resides in the getUserLanguage function within classes/class.database.php, where the user_id parameter is not sanitized before being used in database queries. This allows an attacker to inject arbitrary SQL commands through the affected parameter [1].

Attack

Vector and Prerequisites The attack can be performed remotely without authentication, as demonstrated in proof-of-concept material [1]. No special privileges are required to exploit this vulnerability. The product follows a rolling release model, which complicates the identification of exact affected versions, but any installation prior to the patched commit is vulnerable.

Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying database, potentially allowing attackers to retrieve, modify, or delete sensitive data. The CVSS v3 score of 7.3 (High) reflects the severity of the integrity and confidentiality impacts [1].

Mitigation

Status The vendor was contacted but did not respond, and no official advisory or patch has been released. As a result, users of the affected software are advised to apply input validation or parameterized queries to mitigate the risk until an update becomes available. The vulnerability is considered unpatched as of the publication date [1].