CVE-2026-114440: oretnom23 php-travel-agency-system delete.php sql injection
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied severity vector. Systems exposing the affected admin/delete.php functionality are the relevant attack surface.
Which inputs are implicated?
The affected endpoint accepts the parameters costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id. Manipulation of these arguments can lead to SQL injection.
Are fixed or affected versions known?
No version details are available because the product uses continuous delivery with rolling releases. The project was notified through an issue report but had not responded at the time of the provided information.
How urgent is remediation?
Public exploit availability is reported, and the issue is rated high severity with impacts to confidentiality, integrity, and availability. Prioritize restricting exposure to the affected administrative deletion endpoint until a verified update or vendor response is available.