# CVE-2026-114441: oretnom23 PHP Travel Agency System SQL injection in admin update

Source: https://junglewise.ai/threats/cve-2026-114441-a-weakness-has-been-identified-in-oretnom23-php-travel-agency  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114441 · Severity: high · CVSS 7.3 · Published 2026-10-21

An online travel agency booking system contains a SQL injection vulnerability in its admin update functionality that allows unauthenticated attackers to modify any database record. An attacker can alter customer information, payments, visa statuses, employee salaries, and other critical business data without logging in, compromising data integrity and enabling further attacks like stored XSS.

Technologies: [Oretnom23 Php-Travel-Agency-System](https://junglewise.ai/threats/technologies/php-travel-agency-system). Vendors: [Oretnom23](https://junglewise.ai/threats/vendors/oretnom23).

## Quick answers

**Is CVE-2026-114441 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114441 being exploited in the wild.

**How severe is CVE-2026-114441?** High severity, with a CVSS score of 7.3, published 21 October 2026.

**Which products and versions are affected?** Oretnom23 Php-Travel-Agency-System rolling release model; specific versions not available.

**Is there a fix for CVE-2026-114441?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114441 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114441?** Check whether you run Oretnom23 Php-Travel-Agency-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The admin/update.php file constructs SQL UPDATE statements by directly concatenating unescaped POST parameters (action, full_name, visa_no, hiden, title, description, page_id, user) into both SET and WHERE clauses without prepared statements or escaping. The session check fails to prevent unauthenticated access, allowing anonymous attackers to inject SQL via tautology payloads (e.g., page_id=22' or '1'='1) to mass-modify any table including pages, customers, payments, tickets, employees, and salaries.

## Affected products

- oretnom23 PHP Travel Agency System rolling release model; specific versions not available

## Timeline

- 2026-10-21: disclosed: CVE-2026-114441 published
- 2026-10-08: other: Issue #4 reported on GitHub

## References

- [https://github.com/oretnom23/php-travel-agency-system/](https://github.com/oretnom23/php-travel-agency-system/)
- [https://github.com/oretnom23/php-travel-agency-system/issues/4](https://github.com/oretnom23/php-travel-agency-system/issues/4)

## Related threats

- [oretnom23 PHP Travel Agency System SQL injection in contact form](https://junglewise.ai/threats/cve-2026-117516-a-weakness-has-been-identified-in-oretnom23-php-travel-agency)
- [oretnom23 php-travel-agency-system SQL injection in traceapplication.php](https://junglewise.ai/threats/cve-2026-117515-a-security-flaw-has-been-discovered-in-oretnom23-php-travel)
- [oretnom23 PHP Travel Agency System SQL injection in admin pages](https://junglewise.ai/threats/cve-2026-117514-a-vulnerability-was-identified-in-oretnom23-php-travel-agency)
- [oretnom23 PHP Travel Agency System SQL injection in admin search](https://junglewise.ai/threats/cve-2026-117513-a-vulnerability-was-determined-in-oretnom23-php-travel-agency)
- [PHP Travel Agency System unrestricted file upload in admin/employee_insert.php](https://junglewise.ai/threats/cve-2026-117512-a-vulnerability-was-found-in-oretnom23-php-travel-agency-system)