The vulnerability exists in the manage_flight.php component of the Airline Reservation System and permits an attacker to manipulate the ID parameter to inject arbitrary SQL statements. This can result in unauthorized reading or modification of database contents, including sensitive flight and passenger data. The flaw is a classic injection flaw (CWE-74, CWE-89) and, according to the description, is exploitable remotely without authentication.

The affected product is the itsourcecode Airline Reservation System version 1.0. The specific file is /admin/manage_flight.php, and the issue involves an unknown function that processes the ID argument. All installations of version 1.0 that include this file are potentially affected.

The CVSS score of 6.9 indicates a moderate risk level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the public disclosure and documented remote attack method suggest it can be exploited in real-world scenarios. Because the flaw is remote and leverages unauthenticated input, an attacker does not need special credentials to trigger it.