Technical impact
This vulnerability is a classic input‑based SQL injection that allows a remote attacker to inject arbitrary SQL statements into requests processed by the delete.php file. By manipulating any of the parameters costomer_id, ticket_id, payment_id, etc., an attacker can read, modify, or delete records in the underlying database. The vulnerability is reflected by a CVSS score of 6.9, indicating moderate to high risk to confidentiality and integrity.
Affected Systems
The product affected is oretnom23's php‑travel‑agency‑system, specifically an unnamed portion of admin/delete.php. No version information is provided and the project uses continuous delivery, so every deployed instance of the application is potentially vulnerable until a fix is released. Without a release note, all current deployments are considered at risk.
Risk and Exploitability
The attack can be launched remotely via normal HTTP requests, and an exploit is publicly available, suggesting that attackers could easily craft the required payloads. Because the EPSS score is not listed, the exact likelihood is unknown, but the presence of a publicly documented exploit and the lack of a patch increase the probability of exploitation. The vulnerability is not yet listed in CISA's KEV catalog, but its impact remains significant for systems that expose the delete.php functionality without proper input validation.
