Threats tagged 'ghsa-w6gg-j6xx-qx64'

A SQL injection vulnerability exists in the /results.php file of the Search component in ashraf-kabir travel-agency software up to commit 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. The vulnerability arises from improper handling of the user_query argument, allowing remote attackers to manipulate SQL queries. The product does not use versioning, so affected versions cannot be precisely identified. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 6.3.