---
id: "CVE-2026-114440"
kind: "vulnerability"
aliases: ["CVE-2026-114440"]
title: "oretnom23 PHP travel agency system: SQL injection in admin/delete.php"
severity: "high"
cvss: 7.5
epss: 0.00343
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "self-hosted", "sql-injection", "travel-booking"]
not_affected_if: ["admin-not-exposed", "not-using-this-project"]
published_at: "2026-10-21T23:17:25+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:16:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114440", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114440", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# oretnom23 PHP travel agency system: SQL injection in admin/delete.php

The admin/delete.php file in oretnom23's php-travel-agency-system passes several id parameters (such as customer_id, ticket_id, payment_id, user_id) into SQL queries without proper sanitization. A remote attacker can use this to read or alter the application's database, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment includes `admin/delete.php` from oretnom23's php-travel-agency-system project
- Confirm the installed version or commit: unknown, the sources say the project uses rolling releases with no version details

## Fix

- unknown: the sources say the project has not responded and no fixed release is listed
- Until a fix exists, restrict access to the admin area to trusted networks, or remove or block the `admin/delete.php` endpoint

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114440
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114440

## From the sources

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_