CVE-2026-117516 — Php-Travel-Agency-System
HIGHCVE-2026-117516 is a high-severity (CVSS 7.3) CWE-74 vulnerability in oretnom23 php-travel-agency-system. No vendor fix is recorded yet; mitigation options are listed below.
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler.…
Description
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Products
php-travel-agency-systemoretnom23Detection & mitigation playbook
Vendor / applianceDetect
Inventory every oretnom23 php-travel-agency-system deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2026-117516 yet — track the oretnom23 php-travel-agency-system advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-117516 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.