AI-Assisted Ticketing Exploit Exposes Major US Music Festivals

• •A critical SQL injection vulnerability in Front Gate Tickets allowed full administrative access.
• •Ian Carroll used Claude AI to exploit the vulnerability, potentially issuing unlimited tickets.
• •The flaw could expose sensitive customer data and internal credentials across the platform.

Ian Carroll, a security researcher, exploited an unauthenticated SQL injection vulnerability in Front Gate Tickets, a subsidiary of Live Nation, with assistance from Anthropic's Claude AI. This flaw allowed him to gain administrative access to the ticketing platform, potentially issuing unlimited tickets for major US music festivals, including Bonnaroo and Electric Daisy Carnival. The vulnerability stemmed from improper input sanitization in the device API, enabling Carroll to bypass the site's web application firewall. He discovered sensitive data, including employee login information and password reset tokens, but did not redeem any tickets. The incident raises significant concerns about the security of ticketing systems for large events. The vulnerability could allow malicious actors to access customer records and issue complimentary tickets. The researcher reported the issue without exploiting it further.