CVE-2026-117515: oretnom23 php-travel-agency-system traceapplication.php sql injection
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied severity vector. Exploitation involves manipulating the Search argument handled by traceapplication.php.
Is public exploit information available?
Yes. The exploit has been released publicly and may be used in attacks, which increases the practical urgency of assessing exposed instances.
Which deployments can be confirmed as affected?
The affected version identified in the available data is oretnom23 php-travel-agency-system commit 4e28b8f84d72420373dd15c3ae32900beb7e0635. The data does not establish whether other versions or default installations are affected.
Is a vendor fix available?
No fix is identified in the available data. The project was notified through an issue report but had not responded at the time of publication.