---
id: "CVE-2026-117516"
kind: "vulnerability"
aliases: ["CVE-2026-117516"]
title: "PHP Travel Agency System: contact form enables remote SQL injection"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mysql", "other", "php", "self-hosted", "travel-agency"]
not_affected_if: ["endpoint-blocked", "project-not-deployed"]
published_at: "2026-10-27T18:17:36+00:00"
first_seen_at: "2026-10-27T18:32:59+00:00"
updated_at: "2026-10-27T18:34:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117516", "first_seen_at": "2026-10-27T18:32:59+00:00"}]
---

# PHP Travel Agency System: contact form enables remote SQL injection

The contact form handler in contact_insert.php of the oretnom23 php-travel-agency-system project passes the name, company, email, topic, phone and comments fields into SQL without proper escaping. A remote attacker can read or change the site's database, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for contact_insert.php in the web root of the travel agency application and check whether it builds SQL queries from the POST fields name, company, email, topic, phone or comments.
- Send a test request with a single quote in the name field to contact_insert.php and see whether a database error appears.
- unknown for version-specific checks, as the sources do not list affected versions.

## Fix

- unknown: the sources say the project has not responded and no patched version is listed.
- Until a fix exists, restrict access to contact_insert.php or remove the contact form, and switch the queries to parameterized statements.

## Timeline

- 2026-10-27T18:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117516

## From the sources

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_