{"id":"CVE-2026-117516","kind":"vulnerability","aliases":["CVE-2026-117516"],"related":[],"title":"PHP Travel Agency System: contact form enables remote SQL injection","description":"A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The contact form handler in contact_insert.php of the oretnom23 php-travel-agency-system project passes the name, company, email, topic, phone and comments fields into SQL without proper escaping. A remote attacker can read or change the site's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","other","php","self-hosted","travel-agency"],"not_affected_if":["endpoint-blocked","project-not-deployed"],"how_to_check":"- Look for contact_insert.php in the web root of the travel agency application and check whether it builds SQL queries from the POST fields name, company, email, topic, phone or comments.\n- Send a test request with a single quote in the name field to contact_insert.php and see whether a database error appears.\n- unknown for version-specific checks, as the sources do not list affected versions.","fix":"- unknown: the sources say the project has not responded and no patched version is listed.\n- Until a fix exists, restrict access to contact_insert.php or remove the contact form, and switch the queries to parameterized statements.","status":"open","published_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:36+00:00","updated_at":"2026-10-27T18:34:36+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-27T18:34:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources say the project has not responded and no patched version is listed.\n- Until a fix exists, restrict access to contact_insert.php or remove the contact form, and switch the queries to parameterized statements.","reach":"internet","title":"PHP Travel Agency System: contact form enables remote SQL injection","impact":"high","summary":"The contact form handler in contact_insert.php of the oretnom23 php-travel-agency-system project passes the name, company, email, topic, phone and comments fields into SQL without proper escaping. A remote attacker can read or change the site's database, and a public exploit exists.","category":"other","nicknames":[],"who_cares":["php","self-hosted","mysql","travel-agency"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads or modifies the application database remotely without credentials.","analyst_note":"Confirm affected versions and whether any patch or workaround exists; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-117516 is the only source.","how_to_check":"- Look for contact_insert.php in the web root of the travel agency application and check whether it builds SQL queries from the POST fields name, company, email, topic, phone or comments.\n- Send a test request with a single quote in the name field to contact_insert.php and see whether a database error appears.\n- unknown for version-specific checks, as the sources do not list affected versions.","needs_analyst":true,"not_affected_if":["project-not-deployed","endpoint-blocked"],"who_is_affected":"Any site running oretnom23 php-travel-agency-system with the contact form exposed to the internet is affected, since the flaw is reachable remotely from the form's endpoint. Installations that do not deploy this project, or that block contact_insert.php at the web server, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":3345,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117516':13A,16A '-2026':12A,15A 'affect':85C 'agenc':3A,25B,38B,82C 'argument':105C 'attack':58B,111C,130C 'avail':121C 'caus':107C 'chang':62B 'comment':49B 'compani':44B 'compon':97C 'contact':5A,27B,98C 'contact_insert.php':31B,94C 'could':126C 'cve':11A,14A 'databas':66B 'earli':138C 'element':86C 'email':45B 'enabl':7A 'escap':55B 'exist':71B 'exploit':70B,117C 'field':50B 'file':93C 'form':6A,28B,99C 'function':90C 'handler':29B,100C 'host':22B 'identifi':76C 'inform':134C 'initi':114C 'inject':10A,109C 'issu':141C 'made':120C 'manipul':102C 'mysql':17B 'name':43B 'name/company/email/topic/phone/comments':106C 'oretnom23':34B,78C 'pass':41B 'phone':47B 'php':1A,19B,36B,80C 'php-travel-agency-system':35B,79C 'problem':137C 'project':40B,132C 'proper':54B 'public':69B,124C 'read':60B 'remot':8A,57B,115C 'report':142C 'respond':146C 'self':21B 'self-host':20B 'site':64B 'sql':9A,52B,108C 'system':4A,39B,83C 'topic':46B 'travel':2A,24B,37B,81C 'travel-ag':23B 'unknown':89C 'use':128C 'weak':73C 'without':53B 'yet':147C","nicknames":[],"mitigations":[],"who_affected":"Any site running oretnom23 php-travel-agency-system with the contact form exposed to the internet is affected, since the flaw is reachable remotely from the form's endpoint. Installations that do not deploy this project, or that block contact_insert.php at the web server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117516","severity":null,"published_at":"2026-10-27T18:17:36+00:00","modified_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}