{"id":"CVE-2026-114440","kind":"vulnerability","aliases":["CVE-2026-114440"],"related":[],"title":"oretnom23 PHP travel agency system: SQL injection in admin/delete.php","description":"A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The admin/delete.php file in oretnom23's php-travel-agency-system passes several id parameters (such as customer_id, ticket_id, payment_id, user_id) into SQL queries without proper sanitization. A remote attacker can use this to read or alter the application's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","sql-injection","travel-booking"],"not_affected_if":["admin-not-exposed","not-using-this-project"],"how_to_check":"- Check whether the deployment includes `admin/delete.php` from oretnom23's php-travel-agency-system project\n- Confirm the installed version or commit: unknown, the sources say the project uses rolling releases with no version details","fix":"- unknown: the sources say the project has not responded and no fixed release is listed\n- Until a fix exists, restrict access to the admin area to trusted networks, or remove or block the `admin/delete.php` endpoint","status":"open","published_at":"2026-10-21T23:17:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:23+00:00","updated_at":"2026-10-25T03:16:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:16:23Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources say the project has not responded and no fixed release is listed\n- Until a fix exists, restrict access to the admin area to trusted networks, or remove or block the `admin/delete.php` endpoint","reach":"internet","title":"oretnom23 PHP travel agency system: SQL injection in admin/delete.php","impact":"high","summary":"The admin/delete.php file in oretnom23's php-travel-agency-system passes several id parameters (such as customer_id, ticket_id, payment_id, user_id) into SQL queries without proper sanitization. A remote attacker can use this to read or alter the application's database, and a public exploit exists.","category":"other","nicknames":[],"who_cares":["php","self-hosted","travel-booking","sql-injection"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or modifies the application database remotely","analyst_note":"Find out whether admin/delete.php requires an admin login and which project version or commit is affected, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114440.","how_to_check":"- Check whether the deployment includes `admin/delete.php` from oretnom23's php-travel-agency-system project\n- Confirm the installed version or commit: unknown, the sources say the project uses rolling releases with no version details","needs_analyst":true,"not_affected_if":["admin-not-exposed","not-using-this-project"],"who_is_affected":"Deployments of oretnom23's php-travel-agency-system that expose the admin area to the internet or an untrusted network are exposed through the delete endpoint. Installations where the admin path is blocked from outside access, or that do not run this project, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":3429,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114440':12A,15A '-2026':11A,14A 'admin/delete.php':9A,28B,96C 'affect':89C,138C 'agenc':4A,36B,86C 'alter':67B 'applic':69B 'argument':101C 'attack':60B,109C 'avail':118C,143C 'book':26B 'contini':123C 'costom':102C 'custom':44B 'cve':10A,13A 'databas':71B 'deliveri':124C 'detail':136C 'earli':151C 'exist':76B 'exploit':75B,115C 'file':29B,95C 'host':20B 'id':40B,45B,47B,49B,51B 'id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id':103C 'identifi':80C 'inform':147C 'initi':112C 'inject':7A,23B,107C 'issu':154C 'lead':104C 'manipul':98C 'might':120C 'oretnom23':1A,31B,82C 'paramet':41B 'part':92C 'pass':38B 'payment':48B 'php':2A,17B,34B,84C 'php-travel-agency-system':33B,83C 'problem':150C 'product':132C 'project':145C 'proper':56B 'public':74B,117C 'queri':54B 'read':65B 'releas':127C,141C 'remot':59B,113C 'report':155C 'respond':159C 'roll':126C 'sanit':57B 'self':19B 'self-host':18B 'sever':39B 'sql':6A,22B,53B,106C 'sql-inject':21B 'system':5A,37B,87C 'therefor':133C 'ticket':46B 'travel':3A,25B,35B,85C 'travel-book':24B 'unknown':91C 'updat':140C 'use':62B,122C,129C 'user':50B 'version':135C 'vulner':78C 'without':55B 'yet':160C","nicknames":[],"mitigations":[],"who_affected":"Deployments of oretnom23's php-travel-agency-system that expose the admin area to the internet or an untrusted network are exposed through the delete endpoint. Installations where the admin path is blocked from outside access, or that do not run this project, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114440","severity":null,"published_at":"2026-10-21T23:17:25+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114440","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114440","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}