PHP Travel Agency System CVE-2026-117516

No special conditions - remote unauthenticated exploitation against a default-reachable, public-facing feature (the Contact Form Handler / contact_insert.php) of oretnom23 php-travel-agency-system; the injectable inputs (name, company, email, topic, phone, comments) are standard contact-form fields requiring no login or configuration change. The main factors limiting real-world risk are the product's tiny deployment footprint (a demo/tutorial-grade project) and the CVSS-rated Low impact to confidentiality, integrity and availability; the precise database effect (data disclosure versus modification) is not described in the available sources.

This is a classic unauthenticated SQL injection (CWE-89) in a public-facing contact form, and the signals paint a consistent picture of a genuine-but-low-priority issue rather than an urgent one. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates trivial remote reachability with no authentication or user interaction, which raises exploitability, but the impact metrics are uniformly Low (VC:L/VI:L/VA:L), capping the base score at 5.5 (Medium). The vuln.today decision label is 'this_month', not act_now or emergency, consistent with that moderate severity. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or at-scale exploitation; the exploitation signal is limited to a public PoC reference that is not verified as working exploit code. The dominant risk-limiting factor is the product itself: oretnom23's php-travel-agency-system is a small open-source demo/tutorial-grade project with negligible production footprint, so even trivial exploitability translates to very low real-world exposure. No conflicting signals are present, but note two gaps: EPSS is absent (so statistical exploitation probability is unknown), and the exact impact scope of the SQLi (read-only vs. data modification) is not described in the sources.

A remote, unauthenticated attacker submits the public contact form (contact_insert.php) and injects SQL syntax into one of the accepted parameters - name, company, email, topic, phone, or comments - which is concatenated into a backend query. A public PoC reference exists (filed as a GitHub issue) but it is not verified as working exploit code; the trigger mechanism beyond 'manipulation of the argument' is not described in the available sources.