{"id":"CVE-2026-114577","kind":"vulnerability","aliases":["CVE-2026-114577"],"related":[],"title":"php-travel-agency-system: SQL injection in admin insert handler lets attackers read or alter data","description":"A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The php-travel-agency-system admin/insert.php script builds SQL queries from several request parameters without proper escaping. A remote attacker can inject SQL to read, change or delete data in the application's database.","severity":"high","cvss":7.5,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","other","php","self-hosted"],"not_affected_if":["admin-not-public"],"how_to_check":"- Check whether the deployment contains `admin/insert.php` in the php-travel-agency-system code.\n- Confirm the installed version or commit against the upstream repository; the sources do not name a fixed version.","fix":"- unknown: the sources report no patched version and the project has not responded to the report.\n- Until a fix exists, restrict access to the admin directory or remove the public exposure of `admin/insert.php`.","status":"open","published_at":"2026-10-22T02:16:55+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:16:18+00:00","updated_at":"2026-10-25T03:16:18+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:16:18Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report no patched version and the project has not responded to the report.\n- Until a fix exists, restrict access to the admin directory or remove the public exposure of `admin/insert.php`.","reach":"internet","title":"php-travel-agency-system: SQL injection in admin insert handler lets attackers read or alter data","impact":"high","summary":"The php-travel-agency-system admin/insert.php script builds SQL queries from several request parameters without proper escaping. A remote attacker can inject SQL to read, change or delete data in the application's database.","category":"other","nicknames":[],"who_cares":["php","self-hosted","mysql"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the travel agency database remotely","analyst_note":"Confirm whether admin/insert.php requires login and find any patched version or workaround at the NVD entry and the project repository.","how_to_check":"- Check whether the deployment contains `admin/insert.php` in the php-travel-agency-system code.\n- Confirm the installed version or commit against the upstream repository; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["admin-not-public"],"who_is_affected":"Teams running the oretnom23 php-travel-agency-system project, especially if the admin area is reachable from the internet. Deployments that do not run this project or that block the admin directory from outside access are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000603,"input_tokens":3396,"output_tokens":527,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114577':20A,23A '-2026':19A,22A 'admin':9A 'admin/insert.php':36B,84C 'affect':78C 'agenc':4A,34B,74C 'alter':16A 'applic':62B 'argument':94C 'attack':13A,50B,102C 'build':38B 'chang':56B 'code':80C 'compon':87C 'costom':95C 'could':114C 'cve':18A,21A 'data':17A,59B 'databas':64B 'delet':58B 'earli':124C 'escap':47B 'exploit':108C 'file':83C 'found':68C 'handler':11A,89C 'host':29B 'id/payment_type/amount/description/user/uploadimage/full_name/visa_no':96C 'inform':120C 'inject':7A,52B,100C 'insert':10A,88C 'issu':127C 'launch':105C 'let':12A 'made':111C 'manipul':91C 'may':103C 'mysql':24B 'oretnom23':70C 'paramet':44B 'php':2A,26B,32B,72C 'php-travel-agency-system':1A,31B,71C 'problem':123C 'project':118C 'proper':46B 'public':112C 'queri':40B 'read':14A,55B 'remot':49B,106C 'report':128C 'request':43B 'respond':132C 'result':97C 'script':37B 'self':28B 'self-host':27B 'sever':42B 'sql':6A,39B,53B,99C 'system':5A,35B,75C 'travel':3A,33B,73C 'unknown':79C 'use':116C 'vulner':66C,77C 'without':45B 'yet':133C","nicknames":[],"mitigations":[],"who_affected":"Teams running the oretnom23 php-travel-agency-system project, especially if the admin area is reachable from the internet. Deployments that do not run this project or that block the admin directory from outside access are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114577","severity":null,"published_at":"2026-10-22T02:16:55+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114577","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114577","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}