An unauthenticated SQL injection vulnerability in Net-Billetterie 2.9 allows remote attackers to compromise database contents and bypass authentication mechanisms.

The application fails to properly sanitize user-supplied input in the login POST parameter within the login.inc.php script before including it in a database query. This flaw enables an unauthenticated attacker to inject malicious SQL commands, potentially leading to unauthorized data exfiltration.

A successful exploit grants an attacker the ability to interact directly with the backend database, leading to the unauthorized disclosure of sensitive information such as user credentials, system configuration details, and potentially personally identifiable information. Given the CVSS score of 8.2, this vulnerability represents a high risk to organizational security, as it allows for complete database compromise without requiring any prior authentication.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login interface or consider migrating to a more secure and supported ticketing solution.

Proactive Monitoring: Review web server access logs for anomalous POST requests to login.inc.php that contain SQL syntax characters such as single quotes, semicolons, or comment sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login parameter.

Public Exploit Available: Yes, a functional proof of concept is available via the Exploit-DB entry 45863.

The vulnerability in Net-Billetterie 2.9 is severe and poses a significant risk due to its unauthenticated nature and the availability of public exploit material. Organizations utilizing this software must prioritize isolating the affected application from public networks immediately. Since a vendor-supplied patch is not confirmed, decommissioning or replacing the software is the most effective way to eliminate this critical security gap.