AI helped researcher hack ticketing system for major US music festivals

Key takeaway

• A security researcher using Anthropic's Claude AI discovered a critical vulnerability in Front Gate Tickets, the vendor handling ticketing for nearly every major US music festival.

• The researcher was able to gain administrator access and issue free tickets for any event through a SQL injection flaw that Claude helped bypass.

• Front Gate patched the issue within 24 hours after being notified, and the incident demonstrates both the power of AI in finding security bugs and the risks posed when a single vendor controls ticketing for an entire category of high-value events.

3 Key Points

FAQ

What was the actual vulnerability Carroll found?

Carroll found a SQL injection vulnerability—a common flaw where attackers input commands into a text field that run on the site's backend. Front Gate had a web application firewall blocking the exploit, but Claude discovered that a nested SQL query (a SQL query inside another SQL query) could evade the firewall's detection.

Did Carroll actually issue any fraudulent tickets?

No. Carroll found he could add high-value Bonnaroo tickets like a $4,000 Platinum pass to his cart after taking over a staff administrator's account, but he did not complete any orders or issue tickets for fear of crossing a legal line and being charged with fraud.

What customer data would have been exposed?

Carroll found he could access a table of 500 databases containing customer information including names, emails, and mailing addresses, but not credit card details. He also gained access to staff data.