php-travel-agency-system EUVD-2026-107705

Exploitation targets the specific parameters costomer_id, payment_type, amount, description, user, uploadimage, full_name and visa_no handled by admin/insert.php (the Insertion Handler component) of php-travel-agency-system. The vendor CVSS vector asserts no privileges required (PR:N), but the endpoint resides under the 'admin/' path, strongly implying an authenticated administrative context - this is the primary limiting factor and must be verified, since if admin authentication is enforced the attacker first needs valid admin credentials or a separate auth bypass. No user interaction is required. There is no vendor patch available (the project has not responded to the issue report), so no fixed version limits exposure.

This is a moderate-priority issue that should not be over-escalated despite being a network-exploitable SQL injection (CWE-89). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores it 5.5 with only Low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L), and exploit maturity is marked Proof-of-Concept (E:P). A publicly available exploit exists (VulDB-referenced GitHub issue), which raises real-world likelihood, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation. A key CONFLICT must be flagged: the CVSS vector asserts PR:N (unauthenticated), yet the vulnerable endpoint is 'admin/insert.php' - an administrative insertion handler that typically sits behind an admin login. If authentication is in fact required, real-world risk is materially lower than the unauthenticated vector implies; verify with the vendor or code. The affected product is a small open-source demo/tutorial application with negligible enterprise footprint, so even a working exploit has limited blast radius. Net: a legitimate finding worth patching, but a low-to-moderate priority rather than an emergency.

A remote attacker submits a crafted request to admin/insert.php, injecting malicious SQL through parameters such as customer_id, payment_type, amount, or full_name, which are concatenated into a database query without sanitization. A public proof-of-concept (referenced via the VulDB submission and the project's GitHub issue tracker) exists, lowering the skill needed to reproduce the attack. If the admin endpoint is reachable without authentication (as the CVSS PR:N claims), this allows database content extraction or manipulation.