Description
A weakness has been identified in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /register.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-03-08
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to potential data exposure or unauthorized data manipulation
Action: Immediate Patch
AI Analysis

Impact

A weakness has been identified in the Simple Flight Ticket Booking System’s register.php. Manipulating the Username field allows an attacker to inject arbitrary SQL statements, a classic example of CWE‑89 (SQL Injection) and CWE‑74 (SQL Syntax Error) weaknesses. This can result in confidential data being disclosed, modified, or deleted, and may also provide a foothold for further attacks on the database or application whatsoever.

Affected Systems

The vulnerability affects the Code‑Projects Simple Flight Ticket Booking System version 1.0, specifically the register.php endpoint. No other versions or components are listed as affected in the available data.

Risk and Exploitability

The CVSS score is 6.9, indicating a medium‑to‑high impact severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the foreseeable future, and the vulnerability is not listed in the CISA KEV catalog. Attackers can launch this vulnerability remotely by submitting crafted Username values, and the existence of public exploit code confirms its practicality.

Generated by OpenCVE AI on April 17, 2026 at 12:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s patch for Simple Flight Ticket Booking System 1.0 as soon as it becomes available.
  • Modify the application code to use parameterized queries (prepared statements) for all database interactions, especially for the Username parameter in register.php.
  • Deploy input validation or a web application firewall to detect and block suspicious SQL syntax before it reaches the backend.

Generated by OpenCVE AI on April 17, 2026 at 12:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Carmelo
Carmelo simple Flight Ticket Booking System
CPEs cpe:2.3:a:carmelo:simple_flight_ticket_booking_system:1.0:*:*:*:*:*:*:*
Vendors & Products Carmelo
Carmelo simple Flight Ticket Booking System

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects simple Flight Ticket Booking System
Vendors & Products Code-projects
Code-projects simple Flight Ticket Booking System

Sun, 08 Mar 2026 06:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /register.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title code-projects Simple Flight Ticket Booking System register.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Carmelo Simple Flight Ticket Booking System
Code-projects Simple Flight Ticket Booking System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-10T14:15:36.611Z

Reserved: 2026-03-07T09:11:04.175Z

Link: CVE-2026-3709

cve-icon Vulnrichment

Updated: 2026-03-10T14:15:29.556Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-08T06:16:10.797

Modified: 2026-03-09T16:18:26.403

Link: CVE-2026-3709

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T12:15:18Z

Weaknesses