php-travel-agency-system EUVD-2026-111232

Exploitation targets the 'Search' argument processed by traceapplication.php in oretnom23 php-travel-agency-system; an attacker needs network access to a running instance of this application and submits malicious SQL through that search input. Per the supplied CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) no authentication, user interaction, or non-default configuration is stated as required. The practical limiting factors are: the product is an obscure open-source project with minimal real-world deployment, the public PoC is an unverified issue-report reference rather than confirmed working exploit code, and no fixed version is available because the project has not responded. The exact access context of the traceapplication.php page (public versus authenticated area) is not described in the available sources.

The input provides a CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) scoring 5.5 (medium); no CVSS 3.1 vector, no EPSS score, and no SSVC automatable/technical-impact breakdown were supplied, so several standard prioritization signals are simply absent rather than low. Per PR:N the flaw is reachable by unauthenticated remote attackers, and AC:L/AT:N/UI:N indicate no special complexity or user interaction, but all impact dimensions are rated Low (VC:L/VI:L/VA:L), consistent with a search-parameter SQL injection that yields constrained rather than full database compromise. This is NOT confirmed actively exploited - it is absent from CISA KEV - and the exploit reference is only a public PoC reference (a GitHub issue), not verified as working exploit code. The vendor-neutral priority label is 'this_month', a routine-remediation tier, not act_now or emergency. Weighing these together, this reads as a genuine but low-urgency network SQLi in a niche product: the unauthenticated network vector keeps it real, while medium severity, no KEV, no EPSS, an unverified PoC, and a tiny deployment footprint argue strongly against emergency treatment. Key missing data to note explicitly: EPSS exploitation probability is not provided, and only a CVSS 4.0 vector exists (no 3.1), so cross-framework comparison is limited.

A remote, unauthenticated attacker submits crafted input through the 'Search' argument handled by traceapplication.php, injecting SQL that the application concatenates into a database query to read or manipulate back-end data. A public PoC reference exists (a GitHub issue report); it is not verified as working exploit code, so a functional attack would likely require an attacker to develop or complete the injection payload. The CVSS 4.0 vector (AV:N/AC:L/UI:N) indicates the attack can be launched over the network with low complexity and no user interaction.