This vulnerability exists in the setSync function of the /ajax/add_project.php file in pmTicket Project-Management-Software up to commit 078fa56a782490c5059a0814f84df27984f4d7e2. Manipulation of the conn_settings parameter leads to SQL injection, which can be exploited remotely without authentication. The product's rolling release model means no discrete version numbers are provided for affected or fixed releases. The vendor did not respond to early disclosure, and no patch or mitigation details are available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 6.9 indicates a medium severity impact with low attack complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable endpoint or implementing web application firewall rules to detect and block SQL injection attempts targeting the conn_settings parameter.