Loading story…
A critical unauthenticated SQL injection flaw in the fgtapi.frontgatetickets.com API allowed full administrative takeover of Front Gate Tickets, a Live Nation/Ticketmaster subsidiary that supports major U.S. festivals and events. Researcher Ian Carroll found that device-management endpoints accepted an unsanitized deviceUID parameter through unauthenticated middleware used by scanner and box-office hardware, creating a path to the backend database despite AWS WAF protections. Standard tooling reportedly failed, but a nested-payload bypass enabled a boolean-based blind SQL injection technique that exposed live reset tokens and API credentials and ultimately allowed the hijacking of an administrator account without the password.
With administrator access, an attacker could have manipulated ticket inventory and pricing, issued unlimited complimentary tickets, and accessed customer and staff account data across the platform. The reporting says the flaw was remediated quickly after disclosure, but the incident underscored the risk posed by legacy, internet-facing ticketing infrastructure and showed how AI assistance was used to refine exploitation against protected endpoints when conventional methods were ineffective.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Front Gate Tickets reportedly fixed the vulnerability shortly after it was identified. The remediation closed a path that could have allowed attackers to manipulate inventory and pricing, issue complimentary tickets, and access customer and staff account data.
After standard tooling was ineffective against AWS WAF protections, the researcher used Anthropic's Claude Opus to help identify a nested-payload bypass and build a boolean-based blind SQL injection method. Using the flaw, he accessed the database, read live reset and API tokens, and hijacked an administrator account without the password.
Ian Carroll found a critical unauthenticated SQL injection vulnerability in the fgtapi.frontgatetickets.com API used by Front Gate Tickets, a Live Nation/Ticketmaster subsidiary. The flaw enabled full administrative takeover of the ticketing platform through device-related endpoints that accepted an unsanitized deviceUID parameter.
A report analyzing an exposed repository tied to a Chinese-linked mass WordPress/CMS exploitation operation identified 5,279 unique government or public-sector domains across 26,491 appearances. It found that while most domains appeared in raw target lists, some also appeared in validation outputs, shell inventories, and execution-log-like artifacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WeGIA, a web management platform for charitable institutions, was found to contain two SQL-related vulnerabilities that could let attackers manipulate or fully compromise backend databases. **CVE-2026-33134** affects version `3.6.5` and earlier in `/html/matPat/restaurar_produto.php`, where the `id_produto` parameter is incorporated into SQL queries without proper sanitization, enabling authenticated time-based blind SQL injection and arbitrary SQL command execution. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N` and was fixed in version `3.6.6`. A second flaw, **CVE-2026-33133**, affects versions `3.6.5` and `3.6.6` in the `loadBackupDB()` function, which imports SQL files from uploaded backup archives without validating their contents. A privileged attacker can submit a crafted backup archive containing malicious SQL to create rogue administrator accounts, reset passwords, or perform other unauthorized database operations. The issue is tracked as `CWE-89`, was introduced in commit `370104c`, and was patched in WeGIA version `3.6.7`.
Jun 29, 2026
MITRE has published two high-severity SQL injection vulnerabilities affecting widely available PHP-based management applications: **SourceCodester Payroll Management and Information System v1.0** and **CodeAstro Simple Attendance Management System v1.0**. The SourceCodester issue, tracked as `CVE-2026-37347`, affects `/payroll/view_employee.php` and is classified as `CWE-89`; its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` indicates remote exploitation with no privileges or user interaction required, with high impact to confidentiality and integrity. The CodeAstro flaw, `CVE-2026-37749`, is also a `CWE-89` SQL injection bug and affects `index.php`, where the `username` parameter can be abused by remote, unauthenticated attackers to bypass authentication. Its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` reflects high impact across confidentiality, integrity, and availability. Both CVE entries were updated with severity details and public references, including GitHub documentation, underscoring the exposure of internet-reachable administrative and employee-management functions to straightforward injection attacks.
Jun 29, 2026
Security researchers uncovered significant vulnerabilities in web applications due to broken access control mechanisms, leading to unauthorized privilege escalation and potential system compromise. In one case, a researcher discovered that a SaaS platform inadvertently exposed administrative functionalities to regular users. By simply signing up for a free trial, the user noticed an admin panel link was visible, which should not have been accessible to non-privileged accounts. Initial attempts to access the admin panel resulted in a 403 Forbidden error, but further probing revealed that the access control checks were insufficiently enforced. Through a series of advanced techniques, the researcher was able to escalate privileges, ultimately gaining access to sensitive administrative features and potentially compromising the entire system. This highlights the critical risk posed by misconfigured or broken permission models in enterprise SaaS environments, where a single oversight can grant attackers broad access to internal resources. In a separate incident, a security tester examining a hospital website identified two PHP endpoints protected by 403 Forbidden responses. Despite the initial access denial, the tester experimented with different HTTP methods and payloads, eventually bypassing the restriction by switching from a GET to a POST request and supplying the required form data. The server processed the request as if it were legitimate, exposing a workflow flaw that could allow unauthorized users to submit sensitive information or interact with backend systems. The tester replicated this technique on another endpoint, confirming that the access control logic was consistently weak across multiple parts of the application. Both incidents underscore the prevalence of insecure direct object references and improper authorization checks in modern web applications. Attackers can exploit these weaknesses to move laterally within systems, access confidential data, or disrupt critical workflows. The findings demonstrate the importance of rigorous access control validation, including proper segregation of user roles and comprehensive testing of all endpoints for privilege escalation vectors. Organizations are urged to review their authentication and authorization mechanisms, implement least privilege principles, and conduct regular security assessments to identify and remediate such vulnerabilities before they can be exploited. These real-world examples serve as a cautionary tale for developers and security teams, emphasizing that even seemingly minor oversights in access control can have far-reaching consequences for data security and operational integrity.
Jul 12, 2026