ashraf-kabir travel-agency vulnerabilities

A vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3 in the file /results.php of the Search component. Manipulation of the user_query argument leads to SQL injection. The attack can be launched remotely, and the exploit is now public and may be used. The product does not use versioning, so affected and unaffected releases are unavailable.

A security vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa0 in /admin_area/index.php. Manipulating the edit_pack argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.

A weakness was identified in ashraf-kabir travel-agency up to commit 1f25aa0 in /customer_register.php allowing unrestricted upload. The attack can be launched remotely and the exploit is publicly available. The vendor did not respond.