A SQL injection flaw was found in the Adminupdate.php entry point of the Simple Flight Ticket Booking System 1.0. Malicious manipulation of parameters such as flightno, airplaneid, departure, dtime, arrival, atime, ec, ep, bc, and bp enables an attacker to inject arbitrary SQL statements, potentially exposing, altering, or deleting sensitive data. The weakness maps to CWE‑89 and CWE‑74, reflecting unsanitized input leading to SQL and URL parameter injection.

The affected product is code‑projects Simple Flight Ticket Booking System version 1.0, with the vulnerability localized to the /Adminupdate.php file. No other vendors or products are listed as affected.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score is less than 1%, suggesting a low current exploitation probability. The flaw can be triggered remotely through crafted HTTP requests that target the exposed parameters, and no authentication is required according to the description, which raises the risk of public exploitation. Although it is not listed in the CISA KEV catalog, administrators should treat the vulnerability seriously and remediate promptly.