| Título | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection |
|---|
| Descrição | The affected components are the admin record view/detail/edit pages, which all concatenate GET/REQUEST parameters into `SELECT` (and in some cases `UPDATE`/`DELETE`) statements without escaping:
```php
// admin/customer_detail.php / admin/customer_edit.php
$sql="select*from costomer where costomer_id='$_GET[costomer_id]'";
// admin/ticket_view.php
$sql="select*from ticket where costomer_id='$_GET[costomer_id]'";
// admin/ticket_detail.php / admin/ticket_edit.php
$sql="select*from ticket where ticket_id='$_GET[ticket_id]'";
// admin/payment_view.php / admin/payment_detail.php / admin/payment_edit.php / admin/billcc.php
$sql="select*from payment where costomer_id/payment_id='$_GET[...]'";
// admin/employee_detail.php / admin/employee_edit.php
$sql="select*from employee where emp_id='$_GET[emp_id]'";
// admin/salary_edit.php / admin/salary_view.php / admin/document_view.php /
// admin/document_edit.php / admin/daily_expenditure_edit.php
$sql="select*from salary where salary_id=$_GET[salary_id]"; // unquoted numeric forms too
// admin/artical_edit.php / admin/artical_delete.php
$sql="select * from pages where page_id='$page_id'"; $sql="DELETE from pages where page_id='$page_id'";
// admin/photoupdate.php / admin/document_update.php
$sql="select*from costomer where costomer_id='$_REQUEST[costomer_id]'";
$sql="update costomer set uploadimage='$uploadimage' where costomer_id='$_POST[costomer_id]'";
// admin/payment.php / admin/document.php / admin/ticket.php (record forms)
$cID=$_REQUEST['costomer_id']; $s=mysqli_query($con,"SELECT * FROM costomer WHERE costomer_id='$cID'");
```
The broken session check makes all of them reachable without authentication. A tautology payload (`99999' or '1'='1`) makes each page render the last record of the table regardless of the supplied ID, proving the injection; UNION payloads dump arbitrary data from any table, and the `UPDATE`/`DELETE` variants (`photoupdate.php`, `document_update.php`, `artical_delete.php`) modify or delete rows - `artical_delete.php?page_id=99999' or '1'='1` deletes every page in one request.
|
|---|
| Fonte | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/8 |
|---|
| Utilizador | Weaster (UID 102044) |
|---|
| Submissão | 11/10/2026 15h45 (há 16 dias) |
|---|
| Moderação | 27/10/2026 10h01 (16 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 427080 [oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php costomer_id/ticket_id/emp_id/salary_id/page_id Injeção SQL] |
|---|
| Pontos | 20 |
|---|