php-travel-agency-system CVE-2026-114441

Exploitation targets the administrative endpoint admin/update.php by manipulating any of the parameters action, full_name, visa_no, hiden, title, description, page_id, or user with SQL injection payloads; no non-default configuration is named as required. The principal LIMITING factor is that this is an admin-panel script, which typically requires an authenticated administrative session to reach - contradicting the supplied PR:N rating and warranting source-code verification of the endpoint's access control. Impact is further bounded to Low confidentiality/integrity/availability per the CVSS 4.0 vector, and no CISA KEV or active-exploitation evidence applies; only a proof-of-concept (E:P) exists.

Signals point to a modest, not urgent, priority. The CVSS 4.0 base score is 6.9 (Medium) with vector AV:N/AC:L/PR:N/UI:N and only Low impact to confidentiality, integrity and availability (VC:L/VI:L/VA:L), and the E:P threat metric confirms only proof-of-concept maturity - not active exploitation. It is NOT on CISA KEV, and there is no EPSS value supplied, so widespread automated exploitation cannot be asserted. A public exploit exists (VulDB-referenced GitHub issue), which raises practical reachability, but POC availability is distinct from active exploitation. Key conflict to flag: the vulnerable file is admin/update.php, an administrative endpoint that normally implies prior authentication, yet the supplied CVSS vector sets PR:N (unauthenticated) - this discrepancy should be verified against the actual application code/auth model, as it materially changes risk. The vendor has not responded to the issue report, so no official patch or affected-version boundary is confirmed.

A remote attacker sends a crafted request to admin/update.php, injecting SQL through one of the vulnerable parameters (action, full_name, visa_no, hiden, title, description, page_id, or user) to manipulate backend queries and read or alter travel-agency database records. A public proof-of-concept is available via the referenced GitHub issue, lowering the skill required. Realistic impact is limited (CVSS Low C/I/A), and exploitation likely presupposes reaching the admin module, so effective risk depends on whether that endpoint is authenticated.