Which versions of Simple Flight Ticket Booking System are affected by CVE-2026-11488?

Simple Flight Ticket Booking System 1.0 contains a critical remote SQL injection flaw in the user authentication check that grants database access without credentials.

Is there a public PoC exploit available for CVE-2026-11488?

Yes, a public proof-of-concept exploit is available for CVE-2026-11488. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11488?

24 hours: Identify all deployments of Simple Flight Ticket Booking System 1.0 and assess their network exposure; isolate systems if operationally feasible. 7 days: Deploy WAF (Web Application Firewall) rules to block SQL injection patterns targeting checkUser.php; enable detailed logging and alerting on authentication requests. 30 days: Monitor vendor channels for patch availability; develop and test an upgrade or replacement strategy.

Simple Flight Ticket Booking System CVE-2026-11488

Q: What is the CVSS score of CVE-2026-11488?

CVE-2026-11488 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35019 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-c5x4-8932-5hpr

PHP SQLi Simple Flight Ticket Booking System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 05:16 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown part of the file checkUser.php of the component POST Parameter Handler. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Simple Flight Ticket Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the Username POST parameter in checkUser.php. Publicly available exploit code exists (disclosed via GitHub), increasing the likelihood of opportunistic attacks against exposed instances, though the issue is not listed in CISA KEV. The CVSS 3.1 base score of 7.3 reflects network-reachable, low-complexity exploitation with no privileges or user interaction required.

Technical ContextAI

The affected application is a PHP-based web application (Simple Flight Ticket Booking System 1.0) distributed by code-projects.org, typically deployed on LAMP/WAMP stacks with a MySQL backend. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the Username POST parameter sent to checkUser.php is concatenated into a SQL query without parameterized statements or input sanitization. The CPE cpe:2.3:a:code-projects:simple_flight_ticket_booking_system:*:*:*:*:*:*:*:* indicates all versions are presumed affected, though only 1.0 is explicitly named. checkUser.php is the authentication-handling component, meaning the injection occurs pre-authentication during the login flow.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects.org distributes this as an educational/template project and has no published advisory or fix version referenced in the available data. Operators should replace the vulnerable SQL query construction in checkUser.php with parameterized queries (PDO prepared statements or mysqli_stmt with bind_param) for the Username parameter, and review all other POST parameter handlers in the application for similar issues. Until code is fixed, compensating controls include placing the application behind a WAF with SQLi rules tuned for the login endpoint (trade-off: false positives on legitimate usernames containing special characters), restricting network access to the application via IP allowlisting or VPN (trade-off: blocks intended public booking functionality), and ensuring the database account used by the app has minimum privileges so injection cannot pivot to other databases. Monitor the VulDB record at https://vuldb.com/vuln/369108 for any vendor response.