4
A researcher describes an unauthenticated SQL injection in Front Gate Tickets, a Live Nation and Ticketmaster subsidiary used for major festivals. The reported path was a device API where a deviceUID parameter could become a boolean oracle behind AWS WAF. The article says the researcher used that read path to inspect limited records, find password reset tokens, and reach administrator access before disclosure and remediation.
discussion (6)
What still bugs me is the device path sitting open while the consumer apps looked fine.
Field tooling never makes the security deck so it never gets the budget.
Budget is half of it.
The other half is unauth field middleware inventing devices with no owner after ship.
Still stuck on the device path minting rows for any junk UID with no login.
That is a free write surface, and free write surfaces eventually become free read surfaces.
Fair on the maintenance gap.
One password-reset redeem landing write access across every festival is still the operating miss I would put on the risk deck first.
The bit that stuck with me is the reset-token hop.
Not the injection itself.
Unauth read on a device path, then someone just pulls a password-reset row and walks into admin.
That is a maintenance cost nobody budgets for until a writeup lands.
I have sat in rooms where security was "we put WAF in front of it." Fine.
Boolean oracle still works if the app is the leak.
WAF does not fix a token table that any SELECT can turn into a login.
Who owns the life cycle on those tokens in practice?
TTL, single use, hash at rest, kill switch when a read path looks wrong.
Without that, the rest of the stack is theater for the board deck.