Php Travel Agency System
Monthly
SQL injection in oretnom23's php-travel-agency-system lets remote attackers manipulate the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no parameters in admin/insert.php, producing high confidentiality impact and limited integrity impact while availability remains unaffected. Authentication is required per the independent assessment (PR:L), even though the vendor CVSS 4.0 vector claims PR:N; the admin/ endpoint implies valid admin credentials or a separate auth bypass are needed. Publicly available exploit code exists, but the independent assessment treats this as a moderate-priority issue that should not be over-escalated; the project has not responded to the issue report and no vendor-released patch was identified at time of analysis.
SQL injection in oretnom23 php-travel-agency-system's admin/update.php endpoint allows attackers who can reach the administrative interface to manipulate the action, full_name, visa_no, hiden, title, description, page_id, or user parameters and execute arbitrary SQL statements. The project is a rolling-release PHP application without specific affected-version data, and publicly available exploit code exists through the vendor issue tracker. Although the supplied CVSS 4.0 vector rates PR:N, the independent assessment treats this as an admin-panel script requiring an authenticated administrative session (PR:L), with low confidentiality, integrity, and availability impact; no CISA KEV or active-exploitation evidence applies.
SQL injection in the admin/delete.php endpoint of oretnom23's php-travel-agency-system allows remote attackers to manipulate parameters such as costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, or user_id to alter backend SQL queries. Publicly available exploit code exists via the project's GitHub issue, and VulDB reports a CVSS 4.0 score of 6.9, but independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L and flags that access to the admin/ endpoint likely requires an authenticated administrator session despite VulDB's PR:N rating. No CISA KEV entry or confirmed active exploitation is reported at time of analysis.
php-travel-agency-system exposes an unauthenticated session-handling flaw in admin/session.php: by manipulating the user_id argument, a remote attacker can bypass authentication and obtain unauthorized session context with low confidentiality, integrity, and availability impact. The vendor distributes rolling releases with no affected or fixed version data and has not responded to the issue report, so every deployment must be treated as potentially vulnerable. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; CVSS 4.0 scores it 6.9 with PR:N/UI:N, while practical risk is tempered by the product's rarity.
SQL injection in oretnom23's php-travel-agency-system lets remote attackers manipulate the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no parameters in admin/insert.php, producing high confidentiality impact and limited integrity impact while availability remains unaffected. Authentication is required per the independent assessment (PR:L), even though the vendor CVSS 4.0 vector claims PR:N; the admin/ endpoint implies valid admin credentials or a separate auth bypass are needed. Publicly available exploit code exists, but the independent assessment treats this as a moderate-priority issue that should not be over-escalated; the project has not responded to the issue report and no vendor-released patch was identified at time of analysis.
SQL injection in oretnom23 php-travel-agency-system's admin/update.php endpoint allows attackers who can reach the administrative interface to manipulate the action, full_name, visa_no, hiden, title, description, page_id, or user parameters and execute arbitrary SQL statements. The project is a rolling-release PHP application without specific affected-version data, and publicly available exploit code exists through the vendor issue tracker. Although the supplied CVSS 4.0 vector rates PR:N, the independent assessment treats this as an admin-panel script requiring an authenticated administrative session (PR:L), with low confidentiality, integrity, and availability impact; no CISA KEV or active-exploitation evidence applies.
SQL injection in the admin/delete.php endpoint of oretnom23's php-travel-agency-system allows remote attackers to manipulate parameters such as costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, or user_id to alter backend SQL queries. Publicly available exploit code exists via the project's GitHub issue, and VulDB reports a CVSS 4.0 score of 6.9, but independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L and flags that access to the admin/ endpoint likely requires an authenticated administrator session despite VulDB's PR:N rating. No CISA KEV entry or confirmed active exploitation is reported at time of analysis.
php-travel-agency-system exposes an unauthenticated session-handling flaw in admin/session.php: by manipulating the user_id argument, a remote attacker can bypass authentication and obtain unauthorized session context with low confidentiality, integrity, and availability impact. The vendor distributes rolling releases with no affected or fixed version data and has not responded to the issue report, so every deployment must be treated as potentially vulnerable. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; CVSS 4.0 scores it 6.9 with PR:N/UI:N, while practical risk is tempered by the product's rarity.