CVE-2026-10877: SQL Injection in SourceCodester Ferry Ticket System Admin Login

Technical summary

CVE-2026-10877 is a remote SQL injection flaw in the /admin/login.php endpoint of the SourceCodester Ship Ferry Ticket Reservation System. The vulnerability stems from insufficient input validation on the Username parameter, classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection). An unauthenticated network-based attacker can craft malicious input to bypass authentication logic, extract sensitive data from the backend database, or potentially modify database contents depending on the database user's permissions.

Business impact

Compromise of the admin login mechanism exposes the entire ticket reservation system to unauthorized access. An attacker gaining admin credentials could view and modify reservation records, customer payment information, and potentially system configuration. This creates exposure for customer personal data, financial fraud risk, and operational disruption of ferry service bookings. The reputational damage from a public breach of a reservation system would be significant.

Affected systems

SourceCodester Ship Ferry Ticket Reservation System version 1.0 and all earlier versions are confirmed vulnerable. The vulnerability is in the admin login component, meaning any installation of this software is at risk if exposed to the internet or untrusted networks. Organizations using this system should identify all instances in their environment immediately.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and can be executed over the network via HTTP requests to the login endpoint. The CVSS score of 7.3 (HIGH) reflects this low barrier to entry. Public disclosure and availability of working exploits means that threat actors have functional attack code. Automated scanning tools will likely detect vulnerable instances within days.

Remediation

Immediate action is required. Contact SourceCodester for available security updates or patches addressing this vulnerability. If no patch is available or the vendor is unresponsive, consider implementing a Web Application Firewall (WAF) rule to block SQL injection payloads targeting /admin/login.php, or isolating the admin login interface to trusted networks only. A complete audit of database access logs should be performed to determine if the vulnerability has been exploited.

Patch guidance

Check the SourceCodester vendor advisory and website for patched versions beyond 1.0. Apply patches immediately upon availability to all affected instances. Before patching, test in a non-production environment. If no official patch is released in a timely manner, escalate to your vendor contact or consider alternative ticketing software with active security support.

Detection guidance

Monitor web server logs for suspicious SQL syntax in the Username parameter to /admin/login.php, such as single quotes, UNION statements, OR conditions, or comment sequences (-- or /*). Implement network-based detection rules for common SQL injection patterns. Query database audit logs for unexpected admin authentication attempts or unusual query execution. Use Web Application Firewall logs to identify blocked injection attempts. Correlate failed login attempts with source IP addresses to identify scanning activity.

Why prioritize this

This vulnerability merits immediate remediation due to the combination of unauthenticated remote access, direct impact to admin functionality, and public exploit availability. The SQL injection class of vulnerability historically enables full database compromise. The system's role in handling customer reservation and payment data elevates business risk.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects network accessibility (AV:N), low complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The impact spans confidentiality, integrity, and availability of the database tier. The score does not account for the public availability of working exploits or the fact that this vulnerability is not yet on the CISA Known Exploited Vulnerabilities list, which would typically warrant higher priority in practice.

Frequently asked questions