The vulnerability is located in the Simple Flight Ticket Booking System 1.0, specifically the SearchResultRoundtrip.php file. A user can manipulate HTTP arguments to inject arbitrary SQL code. This flaw enables a remote attacker to execute arbitrary database queries, potentially exposing user data, altering reservations, or escalating privileges. The weakness is a classic SQL injection (CWE‑89) and also involves improper input handling (CWE‑74).

Affected are the code‑projects Simple Flight Ticket Booking System, version 1.0, as identified by the vendor and the corresponding CPE registration. No other versions are noted as vulnerable.

The vulnerability has a CVSS base score of 6.9, indicating a medium severity. The EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation at present, and it is not listed in the CISA KEV catalog. The attack vector is remote, facilitated by any user who can submit crafted HTTP requests to the vulnerable page. An attacker could inject SQL fragments, retrieve sensitive data, or modify database contents, thereby compromising confidentiality and integrity of flight booking information.