CVE-2026-117516: oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contactinsert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of oretnom23 php-travel-agency-system that expose the Contact Form Handler and its contact_insert.php endpoint are exposed. The attack can be initiated remotely and requires no privileges or user interaction.
What inputs are involved in exploitation?
The reported SQL injection can be triggered by manipulating the name, company, email, topic, phone, or comments arguments handled by contact_insert.php.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and could be used in attacks, which increases the likelihood of opportunistic exploitation.
Is a vendor fix available?
The provided information does not identify a fix. The project was notified through an issue report but had not responded at the time of publication.
What can be done if a patch is not available?
Restrict or temporarily disable public access to the affected contact form endpoint where operationally feasible. Monitor requests to contact_insert.php, particularly submissions containing suspicious SQL-like input in the listed form fields.