php-travel-agency-system CVE-2026-117513

Exploitation requires sending manipulated input to the customer_name, voucher_no, or emp_name arguments of admin/customer_search.php in the Admin Search Pages component. The supplied CVSS 4.0 vector marks PR:N (no privileges), but the endpoint resides under the admin/ directory, which typically means a valid administrative session is a practical prerequisite - this limiting factor is not confirmed in the sources and conflicts with the vector, so defenders should verify whether the admin search page is reachable pre-authentication in their deployment. No fixed version is available because the project has not responded; the trigger details beyond the named parameters are not described in the available sources.

This is a CWE-89 SQL injection in the admin/customer_search.php search page of oretnom23's php-travel-agency-system, scored only 5.5 (CVSS 4.0 Medium) with vulnerable-system impacts all rated Low (VC:L/VI:L/VA:L). The supplied 4.0 vector lists PR:N (unauthenticated), yet the affected file sits under the admin/ path in the 'Admin Search Pages' component, which strongly implies an authenticated administrative context - this is a conflict between the vector and the described location, and it should be verified rather than treated as confirmed remote-unauthenticated access. No EPSS score and no KEV listing were provided, so there is no signal of active or probable widespread exploitation; status is no confirmed exploitation. A public PoC reference exists (a GitHub issue report) but it is not verified as working exploit code, so it should not be equated with active exploitation. The vuln.today decision label is this_month, and the SSVC-style signals (exploitation only proof-of-concept, low technical impact, niche product) all point to this being a routine, moderate-priority issue to schedule within normal patching cycles rather than an emergency - a modest-severity flaw in a low-footprint hobby application, not a high-urgency priority.

An attacker able to reach the admin customer-search page submits a crafted value in the customer_name, voucher_no, or emp_name parameter that is concatenated into a backend SQL query, allowing injection against the application database. A public PoC reference (a GitHub issue) exists but is not verified as working exploit code, and the exact trigger beyond the named parameters is not detailed in the available sources. Because the endpoint lives under admin/, realistic exploitation likely presupposes access to the administrative interface despite the PR:N marking in the supplied vector.