---
id: "CVE-2026-117514"
kind: "vulnerability"
aliases: ["CVE-2026-117514"]
title: "php-travel-agency-system: SQL injection in admin customer page lets attackers read data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mysql", "other", "php", "self-hosted", "travel-agency"]
not_affected_if: ["admin-not-internet-exposed", "not-deployed"]
published_at: "2026-10-27T17:17:00+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:34:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117514", "first_seen_at": "2026-10-27T17:32:46+00:00"}]
---

# php-travel-agency-system: SQL injection in admin customer page lets attackers read data

The php-travel-agency-system admin page admin/customer_detail.php passes the customer_id, ticket_id, emp_id, salary_id and page_id parameters into SQL queries without proper sanitization. A remote attacker can exploit this to read or manipulate the application's database, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project is deployed: look for `admin/customer_detail.php` in the web root
- Confirm the installed version against the upstream repository, since the sources do not name a fixed version: unknown

## Fix

- No patched version is named in the sources; the project had not responded to the report: unknown
- Restrict access to the admin area by network or IP allowlist until a fix is available
- Replace the parameter handling in admin/customer_detail.php with prepared statements, or remove the application from public exposure

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117514

## From the sources

A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_