An unauthenticated remote code execution vulnerability exists in pmTicket Project-Management-Software, posing a significant risk to system integrity.

The application is susceptible to insecure deserialization within the loadLanguage function of the classes/class.database.php file, which can be triggered by an unauthenticated attacker through the user_id parameter.

Successful exploitation of this deserialization flaw allows an attacker to execute arbitrary code on the underlying server. Given the CVSS score of 7.3, this vulnerability represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential lateral movement within the network.

Immediate Action: As there is currently no official patch available, administrators should restrict network access to the application and monitor for suspicious requests targeting the database classes.

Proactive Monitoring: Review web server access logs for anomalous payloads in the user_id parameter and monitor system processes for unauthorized child processes spawned by the web application service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block serialized objects or suspicious input patterns within URL parameters.

Public Exploit Available: Yes, a public proof-of-concept exists via an asciinema recording.

Due to the lack of an official vendor patch and the availability of technical details regarding the exploit, this vulnerability must be treated with high urgency. Organizations utilizing pmTicket should implement strict ingress filtering and monitor for any signs of exploitation until a formal security update is released by the developer.