CVE-2026-117514: oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customerdetail.php of the component Admin Record Pages. The manipulation of the argument costomerid/ticketid/empid/salaryid/pageid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of oretnom23 php-travel-agency-system that expose the admin/customer_detail.php page are potentially affected. The vulnerable processing is associated with the Admin Record Pages component.
What does an attacker need to exploit it?
An attacker can initiate the attack remotely and does not require privileges or user interaction according to the supplied vector. Exploitation involves manipulating costomer_id, ticket_id, emp_id, salary_id, or page_id parameters.
Is public exploit code available?
Yes. The exploit is publicly available and may be used, increasing the likelihood of attempted exploitation.
What is known about a fix or vendor response?
The project was informed through an issue report but had not responded at the time of publication. No fixed version or workaround is provided in the available data.