A remote attacker can manipulate the Username field in the /login.php script of Simple Flight Ticket Booking System 1.0, resulting in a SQL injection vulnerability that allows arbitrary SQL code execution. The flaw is identified as CWE-74 (SQL injection via untrusted data passed into an SQL statement) and CWE-89 (SQL injection). Once the injection succeeds, the attacker can bypass authentication, read, modify, or delete database records without any additional privileges.

The vulnerability affects code-projects Simple Flight Ticket Booking System version 1.0. No other product versions are listed in the CVE data.

The CVSS base score of 6.9 indicates moderate severity. The EPSS score of less than 1 % suggests the likelihood of exploitation is low currently, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers can target the system over the public internet by sending specially crafted requests to the login.php endpoint with a manipulated Username value, without needing prior credentials.