A weakness exists in the admin section of oretnom23's php‑travel‑agency‑system, specifically in update.php. By supplying crafted values in the action, full_name, visa_no, hiden, title, description, page_id, or user parameters, an attacker can inject arbitrary SQL. This flaw allows uncontrolled SQL commands to be executed on the backend database, leading to data leakage, credential compromise, or unauthorized data modifications. The vulnerability permits remote exploitation – an unauthenticated user can trigger the injection via a crafted HTTP request.

The affected product is oretnom23's php‑travel‑agency‑system. No specific version is documented; the project follows a rolling release model, so the vulnerability could exist in any active release until patched.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, but the vulnerability has a public exploit, so exploitation probability could be non‑negligible. It is not listed in the CISA KEV catalog, but the availability of the exploit and the remote nature of the attack elevate the practical risk. Attackers could use the flaw to bypass authentication boundaries, retrieve or modify database contents without needing credentials.