CVE-2026-96751: pmTicket Management Software SQLi Vulnerability

CVE-2026-96751 Overview

CVE-2026-96751 is a SQL injection vulnerability in pmTicket Project-Management-Software affecting commits up to 078fa56a782490c5059a0814f84df27984f4d7e2. The flaw resides in the setSync function within /ajax/add_project.php, where the conn_settings argument is passed to a database query without proper sanitization. A remote attacker can manipulate this parameter to inject arbitrary SQL statements. The product follows a rolling release model, so no fixed version is enumerated. The vendor was contacted prior to disclosure but did not respond.

Critical Impact

Remote, unauthenticated attackers can inject SQL through the conn_settings parameter, potentially exposing or modifying project management data.

Affected Products

• pmTicket Project-Management-Software (rolling release)
• Commits up to 078fa56a782490c5059a0814f84df27984f4d7e2
• File /ajax/add_project.php, function setSync

Discovery Timeline

• 2026-09-24 - CVE CVE-2026-96751 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96751

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The setSync function in /ajax/add_project.php accepts user-supplied data via the conn_settings argument and incorporates it into a SQL query without parameterization or input validation. Attackers can send crafted HTTP requests over the network without authentication or user interaction. Successful exploitation enables unauthorized data read, modification, or disruption within the backing database.

Root Cause

The root cause is improper neutralization of input used in a SQL statement. The conn_settings parameter flows directly into query construction inside setSync, allowing attacker-controlled strings to alter query logic. Rolling-release delivery means fixes are applied on a per-commit basis rather than through numbered releases.

Attack Vector

Exploitation occurs remotely over the network against the /ajax/add_project.php endpoint. The attacker submits an HTTP request containing a malicious conn_settings value. No authentication or user interaction is required. See the asciinema Demo Recording and VulDB CVE-2026-96751 Details for the published proof of concept.

No verified exploit code is published in the enriched data. The vulnerability mechanism follows a standard pattern: unsanitized input to the conn_settings field is concatenated into a SQL statement executed by the backend.

Detection Methods for CVE-2026-96751

Indicators of Compromise

• HTTP POST or GET requests to /ajax/add_project.php containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in the conn_settings parameter.
• Unexpected database errors or anomalous query patterns originating from the pmTicket application user.
• Outbound connections or data egress from the database host following requests to the affected endpoint.

Detection Strategies

• Deploy web application firewall rules that inspect requests to /ajax/add_project.php and flag SQL injection payloads in the conn_settings parameter.
• Enable database query logging and alert on malformed statements or statements referencing system schemas such as information_schema.
• Correlate web server access logs with database audit logs to identify injection attempts tied to specific client IPs.

Monitoring Recommendations

• Monitor HTTP request volume and payload length against the vulnerable endpoint for anomalies.
• Track authentication-less requests to AJAX endpoints that submit configuration-style parameters.
• Alert on repeated 500 responses from /ajax/add_project.php, which often indicate payload probing.

How to Mitigate CVE-2026-96751

Immediate Actions Required

• Restrict access to the pmTicket web application using network ACLs or a reverse proxy with authentication until a code fix is in place.
• Deploy WAF signatures that block SQL injection payloads targeting the conn_settings parameter on /ajax/add_project.php.
• Audit the database account used by pmTicket and reduce its privileges to the minimum required.

Patch Information

No vendor patch is referenced in the enriched data. The vendor did not respond to the disclosure. Because pmTicket uses a rolling release model, administrators should monitor the upstream repository for commits that replace string concatenation in setSync with parameterized queries. Refer to the VulDB Vulnerability #409005 record for ongoing status.

Workarounds

• Apply a local source code patch converting the vulnerable query in setSync to use prepared statements with bound parameters.
• Add server-side input validation that rejects non-whitelisted characters in conn_settings before the value reaches the database layer.
• Isolate the application behind an authenticated gateway to remove unauthenticated network exposure.