The flaw resides in the file traceapplication.php of oretnom23 php-travel-agency-system. By manipulating the "Search" argument, an attacker can inject arbitrary SQL, allowing the execution of unintended database commands. This can result in unauthorized data disclosure, modification, or deletion, and may lead to broader compromise of application integrity. The vulnerability is supported by CVE references that confirm remote exploitation is possible, and the public exploit release indicates its readiness for use against vulnerable deployments.

The affected product is oretnom23 php-travel-agency-system, specifically the code commit 4e28b8f84d72420373dd15c3ae32900beb7e0635. No additional versioning or vendor variant information is provided beyond the repository state at the time the vulnerability was identified.

The CVSS score of 6.9 denotes a moderate level of severity, and the EPSS score is not publicly available, leaving the exact likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers can target the application remotely by sending crafted HTTP requests to the traceapplication.php endpoint. No authentication or additional constraints are mentioned, suggesting that exploitation is feasible on publicly exposed installations. Given the public availability of an exploit, the risk to any unpatched deployment is significant.