Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-18922: Ticketly 1.0 lets remote attackers add admin accounts
CVE-2018-18922 · published 7 years ago
Summary
The add_user feature in Ticketly version 1.0 can be tricked into creating new administrator accounts when an attacker sends a specially crafted web request to add_user.php. This gives outsiders full control over the system. Apply the vendor's patch or block the add_user.php endpoint until it is secured.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| abisoftgt | ticketly |
1.0 cpe:2.3:a:abisoftgt:ticketly:1.0:*:*:*:*:*:*:* |
Original advisory text
add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.
add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.
References
- https://0day.today/exploit/31658 Exploit Third Party Advisory
- https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-cre... Exploit Third Party Advisory
- https://medium.com/%40javierolmedo/cve-2018-18922-ticketly-1-0-privilege-escalat...
- https://www.exploit-db.com/exploits/45892 Exploit Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-425Direct Request ('Forced Browsing')
Timeline
Published13 Dec 2018
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-18922 · NVD
Track software like this
Free during beta