The vulnerability resides in the Adminadd.php file of the Simple Flight Ticket Booking System 1.0, allowing an attacker to inject arbitrary SQL through flightno, airplaneid, departure, dtime, arrival, atime, ec, ep, bc, or bp parameters. This can lead to unauthorized data disclosure, data modification, or even deletion in the underlying database. The flaw stems from unsanitized input handling, matching CWE-74 and CWE-89.

The affected product is code‑projects Simple Flight Ticket Booking System version 1.0. The official CPE identifier confirms the version. No other versions are listed as vulnerable.

The CVSS base score of 5.1 rates the issue as medium and the EPSS score of less than 1 % indicates a low likelihood of widespread exploitation. The vulnerability is not catalogued in the CISA KEV list. Exploitation is possible over the network and would require an attacker to craft input to the specified parameters via HTTP requests.