---
id: CVE-2026-117513
title: >-
  oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql
  injection
summary: >-
  A vulnerability was determined in oretnom23 php-travel-agency-system. This
  vulnerability affects unknown code of the file admin/customer_search.php of
  the component Admin Search Pages. Executing a manipulation of the argument
  customer_na…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-89
  - CWE-74
vendor: oretnom23
product: php-travel-agency-system
affected:
  - php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635
  - php-travel-agency-system 2592d60d8f2c6e199f02c828c6d6fbc7b5298c96
  - php-travel-agency-system b58513f8371d098650fac656001bf8f59f795d25
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T19:30:40.189030Z'
exploitAvailable: true
published: '2026-10-27'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:30:50.660Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117513'
references:
  - url: 'https://vuldb.com/vuln/427079'
    label: >-
      VDB-427079 | oretnom23 php-travel-agency-system Admin Search Pages
      customer_search.php sql injection
  - url: 'https://vuldb.com/vuln/427079/cti'
    label: 'VDB-427079 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-117513'
    label: CVE-2026-117513 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1024621'
    label: >-
      Submit #1024621 | oretnom23 php-travel-agency-system
      4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection
  - url: 'https://github.com/oretnom23/php-travel-agency-system/issues/7'
  - url: 'https://github.com/oretnom23/php-travel-agency-system/'
tags:
  - cve.org
  - exploit-available
epss: 0.00263
epssPercentile: 0.18252
ingestedAt: '2026-10-27T17:33:23.796Z'
---

## Overview

A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635`
- `php-travel-agency-system 2592d60d8f2c6e199f02c828c6d6fbc7b5298c96`
- `php-travel-agency-system b58513f8371d098650fac656001bf8f59f795d25`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.