Live › vulnerability › CVE-2026-117514
Go to dashboardThe php-travel-agency-system admin page admin/customer_detail.php passes the customer_id, ticket_id, emp_id, salary_id and page_id parameters into SQL queries without proper sanitization. A remote attacker can exploit this to read or manipulate the application's database, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Any deployment of oretnom23 php-travel-agency-system that exposes its admin pages to the network is potentially exposed, since the flaw is reachable remotely. Sites that do not run this application, or keep its admin area off the internet, are less exposed. The sources do not say whether authentication is required to reach the vulnerable page.
No product ranges from the sources yet.
admin/customer_detail.php in the web rootEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-117514")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.