CVE-2026-117514 — Php-Travel-Agency-System
HIGHCVE-2026-117514 is a high-severity (CVSS 7.3) CWE-74 vulnerability in oretnom23 php-travel-agency-system. No vendor fix is recorded yet; mitigation options are listed below.
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record…
Description
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Products
php-travel-agency-systemoretnom23Detection & mitigation playbook
Vendor / applianceDetect
Inventory every oretnom23 php-travel-agency-system deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2026-117514 yet — track the oretnom23 php-travel-agency-system advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-117514 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.