A SQL injection vulnerability exists in the admin/insert.php file of oretnom23's php-travel-agency-system. Manipulating input arguments such as costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no bypasses validation and allows attackers to execute arbitrary SQL statements. The attack vector is remote, as the vulnerable parameters can be sent over a network request. This flaw can compromise database confidentiality, integrity, and potentially availability, exposing sensitive data like customer details or payments.

The affected product is oretnom23's php-travel-agency-system. No specific version information is provided, meaning any deployment containing the unpatched admin/insert.php component is potentially vulnerable. The vulnerability affects the Insertion Handler module exposed through web interfaces.

The CVSS score of 6.9 indicates a moderate to high risk. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog, but the public disclosure of the exploit means it could be actively used at any time. Exploitability is straightforward because the injection can be triggered via normal HTTP requests without requiring advanced skills. Consequently, the risk to organizations that host this system remains significant pending remediation.