Tickera < 3.5.2.5 - Ticket leakage through IDOR

Proof of Concept

After a user has bought a ticket, an example of a ticket would look like

https://www.website.com/?download_ticket=1&order_key=1234567890&download_ticket_nonce=ab903b7c71, but due to missing validation, the URL can be shortened to https://www.website.com/?download_ticket=1&order_key=1234567890.

This allows an attacker to take the ID value from another purchase in the download_ticket parameter and iterate through the order_key parameter from 00000000 to 99999999 and steal tickets from other participants