ITSOURCECODE AIRLINE RESERVATION SYSTEM · CVE-2026-124581 · Other
NO FIX YET
itsourcecode Airline Reservation System 1.0 has an SQL injection flaw in the ID parameter of /admin/manage_flight.php. A remote attacker can manipulate that input to run arbitrary database queries, and a public exploit has been disclosed.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running the itsourcecode Airline Reservation System 1.0 web application, where the admin flight management page is reachable. The sources do not say whether authentication is required to reach that page, so the exposure depends on how the admin area is deployed.
Who cares airline-reservation-system, php, self-hosted, sql
Unknown from the sources.
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.