{"id":"CVE-2026-117514","kind":"vulnerability","aliases":["CVE-2026-117514"],"related":[],"title":"php-travel-agency-system: SQL injection in admin customer page lets attackers read data","description":"A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The php-travel-agency-system admin page admin/customer_detail.php passes the customer_id, ticket_id, emp_id, salary_id and page_id parameters into SQL queries without proper sanitization. A remote attacker can exploit this to read or manipulate the application's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","other","php","self-hosted","travel-agency"],"not_affected_if":["admin-not-internet-exposed","not-deployed"],"how_to_check":"- Check whether the project is deployed: look for `admin/customer_detail.php` in the web root\n- Confirm the installed version against the upstream repository, since the sources do not name a fixed version: unknown","fix":"- No patched version is named in the sources; the project had not responded to the report: unknown\n- Restrict access to the admin area by network or IP allowlist until a fix is available\n- Replace the parameter handling in admin/customer_detail.php with prepared statements, or remove the application from public exposure","status":"open","published_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:35+00:00","updated_at":"2026-10-27T17:34:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T17:34:35Z","model":"claude-haiku-5-5","output":{"fix":"- No patched version is named in the sources; the project had not responded to the report: unknown\n- Restrict access to the admin area by network or IP allowlist until a fix is available\n- Replace the parameter handling in admin/customer_detail.php with prepared statements, or remove the application from public exposure","reach":"internet","title":"php-travel-agency-system: SQL injection in admin customer page lets attackers read data","impact":"high","summary":"The php-travel-agency-system admin page admin/customer_detail.php passes the customer_id, ticket_id, emp_id, salary_id and page_id parameters into SQL queries without proper sanitization. A remote attacker can exploit this to read or manipulate the application's database, and a public exploit exists.","category":"other","nicknames":[],"who_cares":["php","mysql","travel-agency","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the application database remotely","analyst_note":"Find out the affected version range and whether any fix or upstream response exists; the NVD entry is the only source.","how_to_check":"- Check whether the project is deployed: look for `admin/customer_detail.php` in the web root\n- Confirm the installed version against the upstream repository, since the sources do not name a fixed version: unknown","needs_analyst":true,"not_affected_if":["not-deployed","admin-not-internet-exposed"],"who_is_affected":"Any deployment of oretnom23 php-travel-agency-system that exposes its admin pages to the network is potentially exposed, since the flaw is reachable remotely. Sites that do not run this application, or keep its admin area off the internet, are less exposed. The sources do not say whether authentication is required to reach the vulnerable page.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":3360,"output_tokens":633,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117514':18A,21A '-2026':17A,20A 'admin':9A,37B,103C 'admin/customer_detail.php':39B,99C 'affect':92C 'agenc':4A,30B,35B,88C 'applic':71B 'argument':110C 'attack':13A,62B,123C 'avail':129C 'compon':102C 'costom':111C 'custom':10A,42B 'cve':16A,19A 'data':15A 'databas':73B 'earli':141C 'emp':46B 'exist':78B 'exploit':64B,77B,126C 'file':98C 'host':27B 'id':43B,45B,47B,49B,52B 'id/ticket_id/emp_id/salary_id/page_id':112C 'identifi':82C 'inform':137C 'initi':121C 'inject':7A,116C 'issu':91C,144C 'lead':113C 'let':12A 'manipul':69B,107C 'might':131C 'mysql':22B 'oretnom23':84C 'page':11A,38B,51B,105C 'paramet':53B 'pass':40B 'php':2A,24B,33B,86C 'php-travel-agency-system':1A,32B,85C 'possibl':119C 'problem':140C 'process':95C 'project':135C 'proper':58B 'public':76B,128C 'queri':56B 'read':14A,67B 'record':104C 'remot':61B,124C 'report':145C 'respond':149C 'salari':48B 'sanit':59B 'self':26B 'self-host':25B 'sql':6A,55B,115C 'system':5A,36B,89C 'ticket':44B 'travel':3A,29B,34B,87C 'travel-ag':28B 'unknown':94C 'use':133C 'vulner':80C 'without':57B 'yet':150C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of oretnom23 php-travel-agency-system that exposes its admin pages to the network is potentially exposed, since the flaw is reachable remotely. Sites that do not run this application, or keep its admin area off the internet, are less exposed. The sources do not say whether authentication is required to reach the vulnerable page.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117514","severity":null,"published_at":"2026-10-27T17:17:00+00:00","modified_at":"2026-10-27T17:17:00+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}