CVE-2026-5847: Movie Ticketing System Info Disclosure

CVE-2026-5847 Overview

A vulnerability has been identified in code-projects Movie Ticketing System 1.0 that exposes sensitive information through an improperly secured SQL database backup file. The vulnerable component is the SQL Database Backup File Handler, specifically affecting the file /db/moviedb.sql. This information disclosure vulnerability allows remote attackers to access the database backup file without proper authentication, potentially exposing sensitive data including user credentials, transaction records, and system configuration details.

Critical Impact
Remote attackers can access the exposed SQL database backup file to extract sensitive information including potential user credentials, personal data, and system configuration details without authentication.

Affected Products

code-projects Movie Ticketing System 1.0
Systems with exposed /db/moviedb.sql backup files
PHP-based Movie Ticketing System installations

Discovery Timeline

April 9, 2026 - CVE-2026-5847 published to NVD
April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5847

Vulnerability Analysis

This vulnerability represents a classic sensitive information disclosure issue (CWE-200) in the Movie Ticketing System application. The core problem lies in the improper access control of the SQL database backup file located at /db/moviedb.sql. When this file is accessible via the web server without proper authentication or access restrictions, any remote user can download the complete database backup containing sensitive application data.

The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against vulnerable installations. Remote exploitation requires no special privileges, though user interaction may be involved in accessing the exposed resource.

Root Cause

The vulnerability stems from improper access control configuration on the /db/moviedb.sql file. Database backup files are stored within the web-accessible directory structure without appropriate access restrictions. This is a common configuration mistake in PHP applications where developers place sensitive files in publicly accessible locations or fail to configure proper .htaccess rules to prevent direct file access.

Attack Vector

The attack is network-based and can be launched remotely. An attacker can directly request the database backup file via a standard HTTP request to the vulnerable endpoint. Since the file is accessible without authentication, the attacker receives the complete SQL backup containing all database tables, user records, and potentially sensitive configuration data.

The exploitation process involves:

Identifying a vulnerable Movie Ticketing System installation
Directly accessing the /db/moviedb.sql file path via HTTP request
Downloading the exposed database backup file
Extracting sensitive information from the SQL dump including user credentials, personal information, and transaction records

For technical details and the full vulnerability report, refer to the GitHub Vulnerability Report.

Detection Methods for CVE-2026-5847

Indicators of Compromise

Unusual HTTP requests targeting /db/moviedb.sql or similar database backup file paths
Web server access logs showing successful (HTTP 200) responses for .sql file requests
Evidence of database dump downloads from unexpected IP addresses
Abnormal bandwidth consumption from the database backup directory

Detection Strategies

Monitor web server access logs for requests to /db/, /backup/, or paths containing .sql file extensions
Implement alerting for successful file downloads from database-related directories
Deploy web application firewall (WAF) rules to block direct access to .sql files
Conduct periodic security scans to identify exposed sensitive files in web-accessible directories

Monitoring Recommendations

Enable detailed access logging on directories containing database backup files
Implement real-time alerting for access attempts to sensitive file paths
Use file integrity monitoring on database backup directories to detect unauthorized access
Review server configurations regularly to ensure backup files are not web-accessible

How to Mitigate CVE-2026-5847

Immediate Actions Required

Remove or relocate the /db/moviedb.sql file outside of the web-accessible directory structure immediately
Implement access controls to deny direct HTTP access to all .sql files
Review web server access logs for any evidence of prior exploitation
Change all database credentials if the backup file may have been accessed by unauthorized parties
Audit the application for other potentially exposed sensitive files

Patch Information

No official patch is currently available from the vendor. Organizations using this software should implement the recommended workarounds immediately and monitor for updates from Code Projects. Additional vulnerability details are available through VulDB #356373.

Workarounds

Move database backup files to a directory outside the web root (e.g., /var/backups/ instead of within the web-accessible /db/ folder)
Add .htaccess rules or web server configuration to deny access to .sql files
Implement authentication requirements for accessing any backup or database directories
Use scheduled tasks to automatically remove or secure backup files after creation

bash

# Apache .htaccess configuration to block SQL file access
# Add this to your .htaccess file in the web root
<FilesMatch "\.sql$">
    Require all denied
</FilesMatch>

# Alternative: Deny access to entire db directory
<Directory "/var/www/html/db">
    Require all denied
</Directory>