---
id: "CVE-2026-124581"
page: "https://infrastack.ai/live/CVE-2026-124581"
kind: "vulnerability"
aliases: ["CVE-2026-124581"]
title: "Airline Reservation System: SQL injection in admin flight management page"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "itsourcecode Airline Reservation System", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["airline-reservation-system", "other", "php", "self-hosted", "sql"]
not_affected_if: []
published_at: "2026-11-09T09:16:58+00:00"
first_seen_at: "2026-11-09T09:25:32+00:00"
updated_at: "2026-11-09T09:27:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124581", "first_seen_at": "2026-11-09T09:25:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T09:27:31+00:00"}]
exploit_sources: []
---

# Airline Reservation System: SQL injection in admin flight management page

Link for people: https://infrastack.ai/live/CVE-2026-124581 (this .md is for agents)

itsourcecode Airline Reservation System 1.0 has an SQL injection flaw in the ID parameter of /admin/manage_flight.php. A remote attacker can manipulate that input to run arbitrary database queries, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:itsourcecode Airline Reservation System affected range not listed fixed no fixed version listed

## How to check

Check whether you run itsourcecode Airline Reservation System 1.0 (a PHP project): look for /admin/manage_flight.php in the web root and whether it is reachable without logging in. No fixed version is published in the sources read.

## Timeline

- 2026-11-09T09:25:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124581
- 2026-11-09T09:27:31+00:00 analyst — Search credits exhausted (web-cli 402) and NVD page fetch returned no content; no vendor/maintainer page found. itsourcecode is a free-source-code site, likely no vendor patch. Auth requirement for /admin/manage_flight.php unconfirmed (CVSS vector PR:N suggests none, per VulDB CNA only). Nothing verified. Revisit when search works.

## From the sources

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_