{"id":"CVE-2026-117513","kind":"vulnerability","aliases":["CVE-2026-117513"],"related":[],"title":"php-travel-agency-system: SQL injection in admin customer search lets attackers query the database","description":"A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The admin customer search page (admin/customer_search.php) in the oretnom23 php-travel-agency-system does not sanitize the customer_name, voucher_no and emp_name parameters before using them in SQL queries. A remote attacker can inject SQL to read or change database contents, and the exploit is publicly disclosed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","package","php","self-hosted","travel-agency"],"not_affected_if":["admin-not-exposed"],"how_to_check":"- Look for `admin/customer_search.php` in the deployed application and check whether it builds SQL from `$_GET` or `$_POST` values for `customer_name`, `voucher_no` or `emp_name`\n- Confirm the project version in use; the sources do not name a fixed version","fix":"- No fixed version is named in the sources and the project has not responded to the report; unknown\n- Restrict access to the `admin/` area by IP or VPN until a patch exists\n- Replace the concatenated queries in `customer_search.php` with parameterized prepared statements","status":"open","published_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:36+00:00","updated_at":"2026-10-27T17:34:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T17:34:36Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources and the project has not responded to the report; unknown\n- Restrict access to the `admin/` area by IP or VPN until a patch exists\n- Replace the concatenated queries in `customer_search.php` with parameterized prepared statements","reach":"internet","title":"php-travel-agency-system: SQL injection in admin customer search lets attackers query the database","impact":"high","summary":"The admin customer search page (admin/customer_search.php) in the oretnom23 php-travel-agency-system does not sanitize the customer_name, voucher_no and emp_name parameters before using them in SQL queries. A remote attacker can inject SQL to read or change database contents, and the exploit is publicly disclosed.","category":"package","nicknames":[],"who_cares":["php","travel-agency","self-hosted","mysql"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the application database through injected SQL queries.","analyst_note":"Check whether the admin search page requires an admin login and which versions are affected; sources do not name a fixed version.","how_to_check":"- Look for `admin/customer_search.php` in the deployed application and check whether it builds SQL from `$_GET` or `$_POST` values for `customer_name`, `voucher_no` or `emp_name`\n- Confirm the project version in use; the sources do not name a fixed version","needs_analyst":true,"not_affected_if":["admin-not-exposed"],"who_is_affected":"Any deployment of php-travel-agency-system that exposes the admin customer search page to a network the attacker can reach. Installations where the admin area is only reachable from a trusted internal network are at much lower risk. unknown whether the sources say which versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":3356,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117513':19A,22A '-2026':18A,21A 'admin':9A,33B,105C 'admin/customer_search.php':37B,101C 'affect':95C 'agenc':4A,31B,44B,91C 'argument':113C 'attack':13A,66B,122C 'chang':73B 'code':97C 'compon':104C 'content':75B 'custom':10A,34B,50B,114C 'cve':17A,20A 'databas':16A,74B 'determin':85C 'disclos':81B,133C 'earli':145C 'emp':55B 'execut':108C 'exploit':78B,129C 'file':100C 'host':28B 'inform':141C 'inject':7A,68B,120C 'issu':148C 'lead':117C 'let':12A 'manipul':110C 'may':123C,135C 'mysql':23B 'name':51B,56B 'name/voucher_no/emp_name':115C 'oretnom23':40B,87C 'packag':24B 'page':36B,107C 'paramet':57B 'perform':125C 'php':2A,25B,42B,89C 'php-travel-agency-system':1A,41B,88C 'problem':144C 'project':139C 'public':80B,132C 'queri':14A,63B 'read':71B 'remot':65B,127C 'report':149C 'respond':153C 'sanit':48B 'search':11A,35B,106C 'self':27B 'self-host':26B 'sql':6A,62B,69B,119C 'system':5A,45B,92C 'travel':3A,30B,43B,90C 'travel-ag':29B 'unknown':96C 'use':59B 'util':137C 'voucher':52B 'vulner':83C,94C 'yet':154C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of php-travel-agency-system that exposes the admin customer search page to a network the attacker can reach. Installations where the admin area is only reachable from a trusted internal network are at much lower risk. unknown whether the sources say which versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117513","severity":null,"published_at":"2026-10-27T17:16:59+00:00","modified_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}