The flaw centers on the Username parameter processed in the POST handling of checkUser.php within the Simple Flight Ticket Booking System. The application fails to properly sanitize or bind this input, allowing an attacker to inject arbitrary SQL code into the query executed against the database. Such injection can expose confidential data, alter or delete records, and potentially elevate privileges for the attacker. The vulnerability is a classic injection flaw (CWE-89) stemming from incorrect input handling (CWE-74).

The impacted product is code‑projects Simple Flight Ticket Booking System version 1.0. The vulnerability resides in an undisclosed section of checkUser.php. No other vendors or product versions are listed as affected.

The CVSS score of 6.9 indicates high severity, but the exploit remains feasible over the network because the attacker can trigger it remotely through the public endpoint. Although the EPSS score is not available, the public disclosure and reported exploitation suggest a tangible risk. Because the vulnerability is not listed in the CISA KEV catalog, it may not be widely known to defenders, further increasing the potential for unnoticed compromise.