CVE-2026-117513: oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customersearch.php of the component Admin Search Pages. Executing a manipulation of the argument customername/voucherno/empname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which inputs are implicated in the SQL injection?
The affected admin/customer_search.php search functionality accepts the customer_name, voucher_no, and emp_name arguments. Manipulation of any of these arguments can lead to SQL injection.
Can this be exploited remotely without authentication?
The vulnerability is remotely exploitable, and the supplied vector indicates no privileges or user interaction are required. The affected component is identified as Admin Search Pages.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Is a vendor fix available?
No fix or affected-version information is provided. The project was notified through an issue report but had not responded at the time of the report.