CVE-2026-114577: SQL Injection in oretnom23 php-travel-agency-system

This vulnerability exists in the oretnom23 php-travel-agency-system within the admin/insert.php file's Insertion Handler component. It allows an attacker to perform SQL injection by manipulating one or more of the parameters: costomer_id, payment_type, amount, description, user, uploadimage, full_name, or visa_no. The vulnerability is remotely exploitable without any privileges or user interaction. The project was notified early but has not provided a patch or mitigation. Public exploit code has been published, indicating potential for active exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database impacts depending on the database privileges of the application. The vulnerability is remotely exploitable without authentication, increasing the attack surface. However, no confirmed active exploitation in the wild is reported yet.

No official fix or patch is currently available as the vendor/project has not responded to the issue report. Users should monitor the vendor's channels for updates and consider implementing temporary mitigations such as input validation, parameterized queries, or web application firewalls to block malicious SQL injection attempts until an official fix is released.