---
id: "CVE-2026-117515"
kind: "vulnerability"
aliases: ["CVE-2026-117515"]
title: "php-travel-agency-system: SQL injection in traceapplication.php lets remote attackers query data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "php-travel-agency-system", "fixed": [], "affected": "commit 4e28b8f84d72420373dd15c3ae32900beb7e0635 and earlier (<= V1.0)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["other", "php", "self-hosted", "sql-injection", "travel-booking", "unauthenticated"]
not_affected_if: ["not-deployed", "traceapplication-removed"]
published_at: "2026-10-27T18:17:36+00:00"
first_seen_at: "2026-10-27T18:32:59+00:00"
updated_at: "2026-10-27T18:35:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117515", "first_seen_at": "2026-10-27T18:32:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T18:35:44+00:00"}]
---

# php-travel-agency-system: SQL injection in traceapplication.php lets remote attackers query data

The oretnom23 php-travel-agency-system has an SQL injection flaw in traceapplication.php where the Search argument is passed unsafely to the database. A remote attacker can send crafted input to read or manipulate database contents, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:php-travel-agency-system affected commit 4e28b8f84d72420373dd15c3ae32900beb7e0635 and earlier (<= V1.0) fixed ?

## How to check

- Look for traceapplication.php in the web root (the public Customer Application Tracer page)
- The project has no versions; VulDB lists commit 4e28b8f84d72420373dd15c3ae32900beb7e0635, and older copies (<= V1.0) are affected too
- In traceapplication.php check whether the POST 'search' value is concatenated into the SQL string rather than bound as a parameter
- Check web logs for POSTs to /traceapplication.php with quotes, UNION SELECT or sleep()

## Fix

No fixed version exists; the maintainer has not responded. Stop using the project, or take traceapplication.php offline, or rewrite its search query with prepared statements (PDO/mysqli bound parameters). Put a WAF in front as a stopgap only.

## Timeline

- 2026-10-27T18:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117515
- 2026-10-27T18:35:44+00:00 analyst — VulDB (VDB-427081) confirms unauthenticated SQLi in search param of traceapplication.php, PoC public, maintainer silent, no fix or countermeasure known; repo is an unmaintained sourcecodester demo with no releases. An older audit (Huoxian, <=V1.0) and 2023 nu11secur1ty report show the same search-param SQLi, so it is long-standing. Not exploited in the wild per sources. Sibling CVEs on same repo: 117513, 117514, 114577, 114441. Nothing marked verified (no vendor/maintainer primary text).

## Documents

- [advisory] VulDB VDB-427081: php-travel-agency-system traceapplication.php search SQLi https://vuldb.com/vuln/427081
- [describes] oretnom23/php-travel-agency-system repository https://github.com/oretnom23/php-travel-agency-system
- [poc] PHP-Travel-Agency code audit (traceapplication.php SQLi, <=V1.0) https://zone.huoxian.cn/d/2886-php-travel-agency

## From the sources

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_