CVE-2026-122191: itsourcecode Airline Reservation System manage_booked.php sql injection
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/managebooked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The available CVSS vector indicates that the attacker needs low-level privileges. The vulnerable endpoint is under /admin/, but the data does not specify which application role or authentication mechanism grants access.
Can this be exploited remotely?
Yes. The vulnerability is described as remotely exploitable, requires no user interaction, and has low attack complexity according to the supplied CVSS vector.
What is known about exploit availability?
A proof of concept is flagged, and the exploit has been publicly disclosed. This means organizations running the affected version should assume exploit details may be available to attackers.
How can I determine whether my deployment is affected?
Confirm whether the application is itsourcecode Airline Reservation System version 1.0 and whether /admin/manage_booked.php is present. The reported injection point is the ID argument handled by that file.