# CVE-2026-117515: oretnom23 php-travel-agency-system SQL injection in traceapplication.php

Source: https://junglewise.ai/threats/cve-2026-117515-a-security-flaw-has-been-discovered-in-oretnom23-php-travel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117515 · Severity: high · CVSS 7.3 · Published 2026-10-27

The php-travel-agency-system is a web application for travel agencies to manage bookings and customer visa applications. The public visa-tracing page fails to validate search input, allowing anyone to inject SQL commands and extract sensitive data including customer passport records and administrator credentials, leading to complete application compromise.

Technologies: [Oretnom23 Php-Travel-Agency-System](https://junglewise.ai/threats/technologies/php-travel-agency-system). Vendors: [Oretnom23](https://junglewise.ai/threats/vendors/oretnom23).

## Quick answers

**Is CVE-2026-117515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117515 being exploited in the wild.

**How severe is CVE-2026-117515?** High severity, with a CVSS score of 7.3, published 27 October 2026.

**Which products and versions are affected?** Oretnom23 Php-Travel-Agency-System commit 4e28b8f84d72420373dd15c3ae32900beb7e0635.

**Is there a fix for CVE-2026-117515?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-117515 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-117515?** Check whether you run Oretnom23 Php-Travel-Agency-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The traceapplication.php page concatenates user-supplied search input directly into a LIKE SQL clause without escaping or prepared statements. An unauthenticated attacker can inject UNION-based SQL payloads through the public search form to exfiltrate arbitrary database content, including plaintext admin credentials. No authentication or user interaction is required; the vulnerability is remotely exploitable from the network.

## Affected products

- oretnom23 php-travel-agency-system commit 4e28b8f84d72420373dd15c3ae32900beb7e0635

## Timeline

- 2026-10-11: disclosed: Issue #9 filed on GitHub by ThanatosXingYu
- 2026-10-27: advisory: CVE-2026-117515 published

## References

- [https://github.com/oretnom23/php-travel-agency-system/](https://github.com/oretnom23/php-travel-agency-system/)
- [https://github.com/oretnom23/php-travel-agency-system/issues/9](https://github.com/oretnom23/php-travel-agency-system/issues/9)

## Related threats

- [oretnom23 PHP Travel Agency System SQL injection in contact form](https://junglewise.ai/threats/cve-2026-117516-a-weakness-has-been-identified-in-oretnom23-php-travel-agency)
- [oretnom23 PHP Travel Agency System SQL injection in admin pages](https://junglewise.ai/threats/cve-2026-117514-a-vulnerability-was-identified-in-oretnom23-php-travel-agency)
- [oretnom23 PHP Travel Agency System SQL injection in admin search](https://junglewise.ai/threats/cve-2026-117513-a-vulnerability-was-determined-in-oretnom23-php-travel-agency)
- [PHP Travel Agency System unrestricted file upload in admin/employee_insert.php](https://junglewise.ai/threats/cve-2026-117512-a-vulnerability-was-found-in-oretnom23-php-travel-agency-system)
- [oretnom23 php-travel-agency-system SQL injection in admin/insert.php](https://junglewise.ai/threats/cve-2026-114577-a-vulnerability-was-found-in-oretnom23-php-travel-agency-system)