### Critical Vulnerability Information - **Submission ID**: #657302 - **Title**: pmTicket Project-Management-Software (https://github.com/issue-tracking-system/Project-Management-Software) up to commit 2ef379da2075f4761a2c9029cf91d073474e7486 Authentication Bypass via Insecure Deserialization - **Description**: - The vulnerability exists in the `loadLanguage` function within the `classes/class.database.php` file. - Arbitrary user input (`$_COOKIE['logged']`) is directly passed to the `unserialize()` function without proper validation, leading to insecure deserialization. - Attackers can exploit this vulnerability by crafting malicious cookie values, resulting in object injection and ultimately achieving authentication bypass. - **Sources**: - https://asciinema.org/a/kTWHQMM7n6QH98gGCW3e7T9xT - https://drive.google.com/file/d/18T4Gpzc0OQhzZWR6YoJ127QV3Jxyxe/view?usp=drive_link - **Submitter**: Allan Njuguna (UID 57480) - **Submission Date**: September 17, 2025, 05:09 PM - **Review Date**: September 28, 2025, 11:55 AM - **Status**: Accepted - **VulDB Entry**: 326212 - **Related CVE**: [pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486 Cookie class.database.php loadLanguage user_id deserialization] - **Points**: 20