An unauthenticated SQL injection vulnerability in pmTicket Project-Management-Software allows remote attackers to manipulate database queries, posing a risk to data integrity and confidentiality.

This vulnerability is a SQL injection flaw (CWE-89) located in the getUserLanguage function within classes/class.database.php. An unauthenticated remote attacker can supply a malicious user_id argument to execute arbitrary SQL commands against the backend database.

Successful exploitation allows an attacker to interact with the underlying database, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of project management data, which may include sensitive user information or internal business details.

Immediate Action: Since the vendor has not provided a specific patch for this rolling-release software, administrators should restrict network access to the application and audit the codebase for the vulnerable getUserLanguage function.

Proactive Monitoring: Review database query logs for suspicious patterns, such as unexpected use of UNION, SLEEP, or comment operators often associated with SQL injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious payloads directed at the application.

Public Exploit Available: No (The provided references include a proof-of-concept video, but no weaponized exploit or public repository).

Due to the lack of an official vendor patch and the critical nature of remote SQL injection, users should treat this software as high risk. If immediate remediation is not possible, prioritize isolating the instance from the public internet and implementing stringent input validation at the WAF level.