CVE-2026-5847: Movie Ticketing System Info Disclosure

CVE-2026-5847 Overview

A vulnerability has been identified in code-projects Movie Ticketing System 1.0 that exposes sensitive information through an improperly secured SQL database backup file. The vulnerable component is the SQL Database Backup File Handler, specifically affecting the file /db/moviedb.sql. This information disclosure vulnerability allows remote attackers to access the database backup file without proper authentication, potentially exposing sensitive data including user credentials, transaction records, and system configuration details.

Critical Impact

Remote attackers can access the exposed SQL database backup file to extract sensitive information including potential user credentials, personal data, and system configuration details without authentication.

Affected Products

• code-projects Movie Ticketing System 1.0
• Systems with exposed /db/moviedb.sql backup files
• PHP-based Movie Ticketing System installations

Discovery Timeline

• April 9, 2026 - CVE-2026-5847 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5847

Vulnerability Analysis

This vulnerability represents a classic sensitive information disclosure issue (CWE-200) in the Movie Ticketing System application. The core problem lies in the improper access control of the SQL database backup file located at /db/moviedb.sql. When this file is accessible via the web server without proper authentication or access restrictions, any remote user can download the complete database backup containing sensitive application data.

The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against vulnerable installations. Remote exploitation requires no special privileges, though user interaction may be involved in accessing the exposed resource.

Root Cause

The vulnerability stems from improper access control configuration on the /db/moviedb.sql file. Database backup files are stored within the web-accessible directory structure without appropriate access restrictions. This is a common configuration mistake in PHP applications where developers place sensitive files in publicly accessible locations or fail to configure proper .htaccess rules to prevent direct file access.

Attack Vector

The attack is network-based and can be launched remotely. An attacker can directly request the database backup file via a standard HTTP request to the vulnerable endpoint. Since the file is accessible without authentication, the attacker receives the complete SQL backup containing all database tables, user records, and potentially sensitive configuration data.

The exploitation process involves:

1. Identifying a vulnerable Movie Ticketing System installation
2. Directly accessing the /db/moviedb.sql file path via HTTP request
3. Downloading the exposed database backup file
4. Extracting sensitive information from the SQL dump including user credentials, personal information, and transaction records

For technical details and the full vulnerability report, refer to the GitHub Vulnerability Report.

Detection Methods for CVE-2026-5847

Indicators of Compromise

• Unusual HTTP requests targeting /db/moviedb.sql or similar database backup file paths
• Web server access logs showing successful (HTTP 200) responses for .sql file requests
• Evidence of database dump downloads from unexpected IP addresses
• Abnormal bandwidth consumption from the database backup directory

Detection Strategies

• Monitor web server access logs for requests to /db/, /backup/, or paths containing .sql file extensions
• Implement alerting for successful file downloads from database-related directories
• Deploy web application firewall (WAF) rules to block direct access to .sql files
• Conduct periodic security scans to identify exposed sensitive files in web-accessible directories

Monitoring Recommendations

• Enable detailed access logging on directories containing database backup files
• Implement real-time alerting for access attempts to sensitive file paths
• Use file integrity monitoring on database backup directories to detect unauthorized access
• Review server configurations regularly to ensure backup files are not web-accessible

How to Mitigate CVE-2026-5847

Immediate Actions Required

• Remove or relocate the /db/moviedb.sql file outside of the web-accessible directory structure immediately
• Implement access controls to deny direct HTTP access to all .sql files
• Review web server access logs for any evidence of prior exploitation
• Change all database credentials if the backup file may have been accessed by unauthorized parties
• Audit the application for other potentially exposed sensitive files

Patch Information

No official patch is currently available from the vendor. Organizations using this software should implement the recommended workarounds immediately and monitor for updates from Code Projects. Additional vulnerability details are available through VulDB #356373.

Workarounds

• Move database backup files to a directory outside the web root (e.g., /var/backups/ instead of within the web-accessible /db/ folder)
• Add .htaccess rules or web server configuration to deny access to .sql files
• Implement authentication requirements for accessing any backup or database directories
• Use scheduled tasks to automatically remove or secure backup files after creation

# Apache .htaccess configuration to block SQL file access
# Add this to your .htaccess file in the web root
<FilesMatch "\.sql$">
    Require all denied
</FilesMatch>

# Alternative: Deny access to entire db directory
<Directory "/var/www/html/db">
    Require all denied
</Directory>