The vulnerability resides in the admin/customer_detail.php page of oretnom23’s php-travel-agency-system. By manipulating any of the parameters costomer_id, ticket_id, emp_id, salary_id, or page_id, an attacker can inject arbitrary SQL into the application. This flaw falls under CWE‑89 and causes remote SQL injection, which may allow data exfiltration, modification, or deletion and could potentially lead to broader compromise of the database and application logic.

The affected product is the php-travel-agency-system from vendor oretnom23. No specific version information is disclosed, so any installed instance that includes the admin/customer_detail.php page is potentially vulnerable.

The CVSS score of 6.9 indicates medium severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The flaw is exploitable remotely through standard HTTP requests and an exploit is publicly available. Because no remediation has been released by the vendor, the risk remains moderate to high for organizations running this application.