Exploiting a manipulation of the ID argument in /admin/manage_booked.php enables SQL injection, which can let an attacker read or alter database contents. The weakness arises from the handling of this parameter without proper validation or sanitization, corresponding to CWE-74 and CWE-89. The identified CVSS score of 5.3 indicates a moderate severity, and the vulnerability is considered exploitable remotely with publicly disclosed proof of concept.

Vendors: itsourcecode; product: Airline Reservation System 1.0. The flaw exists in the file /admin/manage_booked.php and affects the publishing version 1.0. No other versions are listed, so the impact is confined to installations of this exact release.

The CVSS score of 5.3 reflects moderate impact; the EPSS is unavailable, and the vulnerability is not in the KEV catalog. Because the attack can be launched remotely and the exploit is publicly disclosed, the likelihood of exploitation remains non‑negligible. Attacks would involve crafting a malicious ID parameter to inject SQL; no special preconditions are listed beyond reaching the vulnerable page.