EUVD-2026-35019
GHSA-c5x4-8932-5hpr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed booking app instance
-
DeliverySend crafted POST to checkUser.php
-
ExploitInject SQL payload via Username parameter
-
ExecutionBypass authentication or extract DB rows
-
ImpactHarvest user credentials and booking data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a network-reachable instance of code-projects Simple Flight Ticket Booking System 1.0 with the checkUser.php endpoint accessible to the attacker - this is the default deployment configuration since checkUser.php is the login handler. No authentication, user interaction, or special configuration is required (AV:N/AC:L/PR:N/UI:N). Practical limiting factors are the application's likely small deployment footprint (a code-projects.org template typically used in academic or hobby contexts rather than production airline systems) and the requirement that the attacker reach the HTTP(S) listener hosting the PHP application. |
| Impact | The CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote, low-complexity, unauthenticated exploitation, which is the worst-case access profile. However, the impact metrics (C:L/I:L/A:L) indicate only partial impact rather than full compromise, yielding the 7.3 base score. The E:P (Proof-of-Concept) and RC:R (Reasonable confidence) temporal metrics align with the publicly disclosed exploit on GitHub. The vulnerability is not listed in CISA KEV and no EPSS score was provided in the input, so widespread mass exploitation cannot be confirmed. The realistic risk is elevated by the fact that this is a small, third-party educational/SMB project unlikely to receive timely vendor patches, and SQLi in a login handler frequently enables authentication bypass or data exfiltration beyond what CVSS partial-impact ratings suggest. Practical risk is moderated by the likely small deployment footprint of this niche application. |
| Exploit ScenarioDerived | An unauthenticated attacker locates an internet-exposed instance of Simple Flight Ticket Booking System and submits a crafted POST request to checkUser.php with a malicious Username payload such as ' OR 1=1-- to bypass authentication or extract data via UNION-based or boolean-based blind injection. Because publicly available exploit code exists at https://github.com/K1venn/cves/issues/1, the technique is reproducible without specialized skill, and the attacker can dump user credentials or booking data from the database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
SQL injection in code-projects Simple Flight Ticket Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the Username POST parameter in checkUser.php. Publicly available exploit code exists (disclosed via GitHub), increasing the likelihood of opportunistic attacks against exposed instances, though the issue is not listed in CISA KEV. The CVSS 3.1 base score of 7.3 reflects network-reachable, low-complexity exploitation with no privileges or user interaction required.
RemediationAI
No vendor-released patch identified at time of analysis - code-projects.org distributes this as an educational/template project and has no published advisory or fix version referenced in the available data. Operators should replace the vulnerable SQL query construction in checkUser.php with parameterized queries (PDO prepared statements or mysqli_stmt with bind_param) for the Username parameter, and review all other POST parameter handlers in the application for similar issues. Until code is fixed, compensating controls include placing the application behind a WAF with SQLi rules tuned for the login endpoint (trade-off: false positives on legitimate usernames containing special characters), restricting network access to the application via IP allowlisting or VPN (trade-off: blocks intended public booking functionality), and ensuring the database account used by the app has minimum privileges so injection cannot pivot to other databases. Monitor the VulDB record at https://vuldb.com/vuln/369108 for any vendor response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected application is a PHP-based web application (Simple Flight Ticket Booking System 1.0) distributed by code-projects.org, typically deployed on LAMP/WAMP stacks with a MySQL backend. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the Username POST parameter sent to checkUser.php is concatenated into a SQL query without parameterized statements or input sanitization. The CPE cpe:2.3:a:code-projects:simple_flight_ticket_booking_system:*:*:*:*:*:*:*:* indicates all versions are presumed affected, though only 1.0 is explicitly named. checkUser.php is the authentication-handling component, meaning the injection occurs pre-authentication during the login flow.
Know when Simple Flight Ticket Booking System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown part of the file checkUser.php of the component POST Parameter Handler. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Simple Flight Ticket Booking System 1.0 contains a critical remote SQL injection flaw in the user authentication check that grants database access without credentials. Because publicly available exploit code exists for this vulnerability, attackers can readily compromise customer data and service integrity at any organization running this software. Immediate protective action is required to prevent likely opportunistic attacks.
Deploy WAF rules to detect and block SQL injection attempts in the Username parameter; enable database query monitoring to detect unauthorized access; implement network-level access restrictions; configure intrusion detection rules for known exploit signatures; establish enhanced logging and alerting on checkUser.php; conduct periodic security assessments. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in Simple Flight Ticket Booking System 1.0's /Admindelete.php endpoint allows unauthenticated remote attac
Simple Flight Ticket Booking System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (
SQL injection in Simple Flight Ticket Booking System 1.0 via the flightno parameter in /Adminsearch.php allows unauthent
SQL injection in Simple Flight Ticket Booking System 1.0's login functionality allows unauthenticated attackers to manip
SQL injection in Simple Flight Ticket Booking System 1.0's SearchResultRoundtrip.php parameter handling enables unauthen
SQL injection in Simple Flight Ticket Booking System 1.0 allows unauthenticated remote attackers to manipulate the Searc
Simple Flight Ticket Booking System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).
SQL injection in Simple Flight Ticket Booking System 1.0's admin update function allows remote attackers with high privi
SQL injection in Simple Flight Ticket Booking System 1.0's /Adminadd.php allows remote attackers with high privileges to
Exploit-DB