php-travel-agency-system CVE-2026-114440

Exploitation targets the admin/delete.php script and requires supplying a malicious value in one of the parameters costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, or user_id, which are passed unsanitized into a SQL statement. The decisive limiting factor is access to the admin/ endpoint: although VulDB rates this PR:N (unauthenticated), the admin/ directory location strongly implies a logged-in administrator session is normally required, so real-world exploitability hinges on whether this script enforces authentication. No special non-default configuration or user interaction is otherwise needed, and the attack is performed remotely over the network.

This is a CWE-89 SQL injection in the admin/delete.php endpoint of oretnom23's php-travel-agency-system, reported by VulDB with a publicly available proof-of-concept and a CVSS 4.0 score of 6.9 (Medium). The input CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with low impact to confidentiality, integrity, and availability, and the embedded E:P threat metric reflects only proof-of-concept maturity - not active exploitation. Critically, the PR:N (unauthenticated) rating CONFLICTS with the code location: delete.php sits under an admin/ directory, which in these applications normally requires an authenticated administrator session - verify whether the endpoint is truly reachable pre-authentication, as this materially changes real-world risk. No EPSS score is provided and the vulnerability is NOT listed in CISA KEV, so there is no evidence of widespread or active exploitation; the only exploitation signal is public PoC availability. Weighing all signals together, this is a genuine but comparatively low-priority issue: the product is an obscure hobby/educational PHP project with negligible enterprise footprint, impact is rated Low across the board, and the vendor has not responded to the issue report, so no patch exists. It warrants prompt attention only for the small number of operators actually running this specific application.

A remote attacker sends a crafted request to admin/delete.php manipulating one of the injectable parameters (e.g. costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, or user_id) to inject SQL into the backend query. Because the parameters are concatenated into a DELETE/SQL statement without sanitization, the attacker can extract or tamper with database contents. A public proof-of-concept exists (linked from the project's GitHub issue tracker), lowering the skill barrier, though exploitation may require a valid admin session depending on how the endpoint is protected.