Description
A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. The manipulation of the argument flightno results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Published: 2026-03-08
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized database access and possible data modification via SQL injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Admindelete.php file of code-projects Simple Flight Ticket Booking System 1.0 allows attackers to manipulate the flightno argument, resulting in SQL injection. This could permit an adversary to read, alter, or delete flight booking data, compromising the confidentiality, integrity, and availability of the database. The vulnerability is classified under CWE‑74 (Improper Handling of Special Elements in SQL Statements) and CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command).

Affected Systems

The affected product is code-projects Simple Flight Ticket Booking System, version 1.0. No other vendors or product versions are listed as impacted.

Risk and Exploitability

A remote attacker can exploit the flaw over the network. The CVSS score of 6.9 indicates a moderate risk, while the EPSS score of less than 1% suggests very low exploitation probability. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to supply a crafted flightno parameter to inject malicious SQL, indicating a web‑based attack path.

Generated by OpenCVE AI on April 16, 2026 at 10:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade to the latest version of Simple Flight Ticket Booking System that addresses the SQL injection in Admindelete.php.
  • Implement strict input validation on the flightno parameter, ensuring only valid numeric flight numbers are accepted.
  • Configure the database account used by the application with the principle of least privilege and consider adding a web application firewall to block suspicious SQL payloads.

Generated by OpenCVE AI on April 16, 2026 at 10:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Carmelo
Carmelo simple Flight Ticket Booking System
CPEs cpe:2.3:a:carmelo:simple_flight_ticket_booking_system:1.0:*:*:*:*:*:*:*
Vendors & Products Carmelo
Carmelo simple Flight Ticket Booking System

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects simple Flight Ticket Booking System
Vendors & Products Code-projects
Code-projects simple Flight Ticket Booking System

Sun, 08 Mar 2026 09:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. The manipulation of the argument flightno results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Title code-projects Simple Flight Ticket Booking System Admindelete.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Carmelo Simple Flight Ticket Booking System
Code-projects Simple Flight Ticket Booking System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-11T15:31:22.627Z

Reserved: 2026-03-07T17:12:27.239Z

Link: CVE-2026-3723

cve-icon Vulnrichment

Updated: 2026-03-11T15:31:19.282Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-08T09:16:17.950

Modified: 2026-03-09T16:19:26.217

Link: CVE-2026-3723

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T10:45:26Z

Weaknesses