CVE-2026-114577
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In oretom23 php-travel-agency-system, admin/insert.php in the Insertion Handler is vulnerable to SQL injection via manipulation of the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no arguments. The attack can be launched remotely, a public exploit is available, and the project has not responded to the report.
Risk Assessment
A remote attacker can inject arbitrary SQL, risking data leakage, modification or deletion, and potential application compromise.
Recommendation
Use parameterized queries and input validation in admin/insert.php. Until patched, restrict access to the admin panel and consider disabling the vulnerable function.
Other vulnerabilities in php-travel-agency-system
See all- CVE-2026-114441High
php-travel-agency-system (oretnom23) in admin/update.php contains an SQL injection vulnerability via manipulation of the action, full_name, visa_no, hiden, title, description, page_id, and user arguments. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-114440High
php-travel-agency-system (oretnom23) in admin/delete.php contains an SQL injection vulnerability via manipulation of the costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id arguments. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-114439High
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected is some unknown functionality of the file admin/session.php of the Session Handler component. Manipulation of the user_id argument can lead to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS