CVE-2026-114441: SQL Injection in oretnom23 php-travel-agency-system

This vulnerability in oretnom23 php-travel-agency-system involves SQL injection via manipulation of several parameters in the admin/update.php endpoint. An attacker can remotely exploit this flaw to inject SQL commands due to insufficient input validation or sanitization. The product's rolling release model means no fixed version information is available. The vendor has been notified but has not provided a fix or comment. The CVSS 4.0 score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code exists, which could facilitate attacks.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The impact is limited to the confidentiality, integrity, and availability of the affected system's data as indicated by the CVSS vector. No evidence of active exploitation in the wild is reported yet.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's channels for updates. In the meantime, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected parameters. Restricting access to the admin/update.php endpoint and validating or sanitizing inputs at the application level may reduce risk until a patch is released.