---
id: "CVE-2026-114577"
kind: "vulnerability"
aliases: ["CVE-2026-114577"]
title: "php-travel-agency-system: SQL injection in admin insert handler lets attackers read or alter data"
severity: "high"
cvss: 7.5
epss: 0.00343
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mysql", "other", "php", "self-hosted"]
not_affected_if: ["admin-not-public"]
published_at: "2026-10-22T02:16:55+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:16:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114577", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114577", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# php-travel-agency-system: SQL injection in admin insert handler lets attackers read or alter data

The php-travel-agency-system admin/insert.php script builds SQL queries from several request parameters without proper escaping. A remote attacker can inject SQL to read, change or delete data in the application's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment contains `admin/insert.php` in the php-travel-agency-system code.
- Confirm the installed version or commit against the upstream repository; the sources do not name a fixed version.

## Fix

- unknown: the sources report no patched version and the project has not responded to the report.
- Until a fix exists, restrict access to the admin directory or remove the public exposure of `admin/insert.php`.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114577
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114577

## From the sources

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_