The vulnerability resides in the administration component of the php-travel-agency-system, specifically the customer_search.php page. An attacker can craft a request that manipulates the customer_name, voucher_no, or emp_name parameters. The input is then incorporated into a SQL query without proper sanitization, resulting in a classic SQL injection flaw. Successful exploitation would allow the attacker to read, alter or delete data stored in the underlying database, potentially compromising customer records and business secrets.

This issue affects the php-travel-agency-system project hosted by oretnom23. Versions with the admin/customer_search.php file, as found in the GitHub repository, are vulnerable. No specific version range is listed, so any revision that has not received a fix from the project should be considered at risk.

The CVSS score of 6.9 indicates a moderate severity score. The EPSS score is unavailable, which prevents an assessment of current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. The attack path is straightforward, as it can be executed remotely from outside the network. Because the issue is publicly disclosed, there is a high chance that exploit code may already exist in the wild. The absence of a vendor-supplied patch further raises the priority of remediations or mitigations.