{"id":"CVE-2026-117515","kind":"vulnerability","aliases":["CVE-2026-117515"],"related":[],"title":"php-travel-agency-system: SQL injection in traceapplication.php lets remote attackers query data","description":"A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The oretnom23 php-travel-agency-system has an SQL injection flaw in traceapplication.php where the Search argument is passed unsafely to the database. A remote attacker can send crafted input to read or manipulate database contents, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"php-travel-agency-system","fixed":[],"affected":"commit 4e28b8f84d72420373dd15c3ae32900beb7e0635 and earlier (<= V1.0)","ecosystem":"vendor"}],"ecosystems":[],"tags":["other","php","self-hosted","sql-injection","travel-booking","unauthenticated"],"not_affected_if":["not-deployed","traceapplication-removed"],"how_to_check":"- Look for traceapplication.php in the web root (the public Customer Application Tracer page)\n- The project has no versions; VulDB lists commit 4e28b8f84d72420373dd15c3ae32900beb7e0635, and older copies (<= V1.0) are affected too\n- In traceapplication.php check whether the POST 'search' value is concatenated into the SQL string rather than bound as a parameter\n- Check web logs for POSTs to /traceapplication.php with quotes, UNION SELECT or sleep()","fix":"No fixed version exists; the maintainer has not responded. Stop using the project, or take traceapplication.php offline, or rewrite its search query with prepared statements (PDO/mysqli bound parameters). Put a WAF in front as a stopgap only.","status":"open","published_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:36+00:00","updated_at":"2026-10-27T18:35:44+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-27T18:34:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"php-travel-agency-system: SQL injection in traceapplication.php lets remote attackers query data","impact":"high","summary":"The oretnom23 php-travel-agency-system has an SQL injection flaw in traceapplication.php where the Search argument is passed unsafely to the database. A remote attacker can send crafted input to read or manipulate database contents, and a public exploit exists.","category":"other","nicknames":[],"who_cares":["php","self-hosted","travel-booking"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the application database remotely","analyst_note":"Check NVD and the project repository for a patch or workaround; the maintainer has not responded, so confirm whether any fixed version exists.","how_to_check":"- Check whether the project is deployed by looking for traceapplication.php in the web root\n- Confirm the deployed commit against `4e28b8f84d72420373dd15c3ae32900beb7e0635`\n- Review the Search handling in traceapplication.php for unparameterized SQL queries","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Teams running the oretnom23 php-travel-agency-system project as a web application that exposes traceapplication.php to the network are exposed. Sites that do not deploy this project can skip it. The sources do not name a patched version and the maintainer has not responded.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000605,"input_tokens":3381,"output_tokens":534,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check NVD and the project repository for a patch or workaround; the maintainer has not responded, so confirm whether any fixed version exists.","search":"'-117515':17A,20A '-2026':16A,19A '4e28':93C 'agenc':4A,43B,91C 'agency':24A 'argument':55B,108C 'attack':12A,64B,120C,135C 'b8f84d72420373dd15c3ae32900beb7e0635':94C 'book':36B 'content':74B 'craft':67B 'cve':15A,18A 'data':14A 'databas':61B,73B 'discov':85C 'earli':143C 'exist':79B 'exploit':78B,123C 'file':102C 'flaw':49B,82C 'function':99C 'host':30B 'impact':95C 'inform':139C 'inject':7A,33B,48B,113C 'input':68B 'issu':146C 'launch':118C 'let':10A 'manipul':72B,105C 'may':131C 'oretnom23':39B,87C 'pass':57B 'php':2A,22A,27B,41B,89C 'php-travel-agency-system':1A,21A,40B,88C 'possibl':116C 'problem':142C 'project':137C 'public':77B,129C 'queri':13A 'read':70B 'releas':126C 'remot':11A,63B,121C 'report':147C 'respond':151C 'result':110C 'search':54B,109C 'secur':81C 'self':29B 'self-host':28B 'send':66B 'sql':6A,32B,47B,112C 'sql-inject':31B 'system':5A,25A,44B,92C 'traceapplication.php':9A,51B,103C 'travel':3A,23A,35B,42B,90C 'travel-book':34B 'unauthent':37B 'unknown':98C 'unsaf':58B 'use':133C 'yet':152C","nicknames":[],"mitigations":[],"who_affected":"Teams running the oretnom23 php-travel-agency-system project as a web application that exposes traceapplication.php to the network are exposed. Sites that do not deploy this project can skip it. The sources do not name a patched version and the maintainer has not responded.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-117515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117515","severity":null,"published_at":"2026-10-27T18:17:36+00:00","modified_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117515:911","url":null,"severity":null,"published_at":"2026-10-27T18:35:44+00:00","modified_at":"2026-10-27T18:35:44+00:00","first_seen_at":"2026-10-27T18:35:44+00:00","fetched_at":"2026-10-27T18:35:44+00:00","note":"VulDB (VDB-427081) confirms unauthenticated SQLi in search param of traceapplication.php, PoC public, maintainer silent, no fix or countermeasure known; repo is an unmaintained sourcecodester demo with no releases. An older audit (Huoxian, <=V1.0) and 2023 nu11secur1ty report show the same search-param SQLi, so it is long-standing. Not exploited in the wild per sources. Sibling CVEs on same repo: 117513, 117514, 114577, 114441. Nothing marked verified (no vendor/maintainer primary text)."}],"documents":[{"id":7376,"url":"https://vuldb.com/vuln/427081","title":"VulDB VDB-427081: php-travel-agency-system traceapplication.php search SQLi","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":7377,"url":"https://github.com/oretnom23/php-travel-agency-system","title":"oretnom23/php-travel-agency-system repository","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":7378,"url":"https://zone.huoxian.cn/d/2886-php-travel-agency","title":"PHP-Travel-Agency code audit (traceapplication.php SQLi, <=V1.0)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}