CVE-2026-114577: oretnom23 php-travel-agency-system SQL injection in admin/insert.php

CVE-2026-114577 · Severity: high · CVSS 7.3 · Published 2026-10-22

The PHP Travel Agency System is a web application for managing travel bookings and financial transactions. An unauthenticated attacker can inject malicious SQL queries through unescaped form inputs in the admin panel, allowing insertion of fraudulent records into the database. This enables attackers to corrupt financial ledgers, create fake payments and tickets, and compromise data integrity without any authentication or user interaction.

Technologies: Oretnom23 Php-Travel-Agency-System. Vendors: Oretnom23.

Quick answers

Is CVE-2026-114577 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114577 being exploited in the wild.
How severe is CVE-2026-114577?
High severity, with a CVSS score of 7.3, published 22 October 2026.
Which products and versions are affected?
oretnom23 php-travel-agency-system.
Is there a fix for CVE-2026-114577?
No fixed version is recorded yet. Apply parameterized queries or prepared statements for all database operations in admin/insert.php. Enforce proper session authentication by terminating script execution if the user is not authenticated, rather than relying on header redirects.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-114577 attacked?
It is attacked over the network.
Am I affected by CVE-2026-114577?
Check whether you run Oretnom23 Php-Travel-Agency-System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Apply parameterized queries or prepared statements for all database operations in admin/insert.php. Enforce proper session authentication by terminating script execution if the user is not authenticated, rather than relying on header redirects.</anigation> </invoke>

Technical details

SQL injection vulnerability in admin/insert.php where POST parameters (costomer_id, payment_type, amount, description, etc.) are concatenated directly into INSERT statements without escaping or prepared statements. The session authentication check only redirects but does not terminate script execution, allowing anonymous access. An attacker can use multi-tuple injection payloads to insert arbitrary records into payment, ticket, daily_expenditure, salary, and document tables.

Affected products

  • oretnom23 php-travel-agency-system

Timeline

  • 2026-10-09: disclosed: Vulnerability reported via GitHub issue
  • 2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.