PHP Travel Agency System CVE-2026-117514

Exploitation requires sending a crafted request to admin/customer_detail.php with an attacker-controlled value in one of the parameters costomer_id, ticket_id, emp_id, salary_id, or page_id, which is passed unsanitized into a SQL query. The principal limiting factor is access to the Admin Record Pages: the endpoint path implies an administrative context that would normally require an authenticated admin session, which directly contradicts the CVSS PR:N (unauthenticated) rating - defenders should confirm whether this endpoint enforces authentication, since that determines whether the flaw is reachable by any remote user or only by logged-in administrators. No special non-default configuration or user interaction is indicated by the sources, and no fixed version exists because the project has not responded to the report.

The input provides a CVSS 4.0 vector scoring 5.5 (medium) with AV:N/AC:L/AT:N/PR:N/UI:N and low impact across all three dimensions (VC:L/VI:L/VA:L), plus exploit maturity E:P (proof-of-concept). The vuln.today decision label is 'this_month' - not act_now or emergency - which aligns with a medium-severity, non-urgent triage. Signals are internally consistent except for one tension: the CVSS vector asserts PR:N (unauthenticated), yet the affected file is admin/customer_detail.php within the 'Admin Record Pages' component, which normally implies an authenticated admin session - this conflict should be verified against the application's actual access controls before accepting unauthenticated exploitation as fact. No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active or widespread exploitation; the only exploitation signal is a public PoC reference (a GitHub issue report), not verified working exploit code. Net assessment: a genuine SQL injection flaw (CWE-89) that matters if the application is internet-exposed, but real-world priority is tempered by the obscure, tiny-footprint product, the absence of KEV/EPSS corroboration, and an unverified PoC - this reads as a real but non-urgent, low-exposure issue rather than a mass-exploitation threat.

A remote attacker reaches admin/customer_detail.php and supplies a malicious value in one of the record identifier parameters (costomer_id, ticket_id, emp_id, salary_id, or page_id), which is concatenated unsafely into a SQL query, allowing extraction or manipulation of database contents. Given AV:N/AC:L, the request can be delivered over the network with low complexity; however, because the endpoint sits in the Admin Record Pages, practical exploitation may depend on whether admin access is actually required, which the sources do not resolve. A public PoC reference exists (the vendor issue report); it is not verified as working exploit code.