| Título | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection |
|---|
| Descrição | The affected component is `traceapplication.php`, a fully public page (no session check at all) where visitors trace their visa application by passport number:
```php
$search = isset($_REQUEST['search'])?trim($_REQUEST['search']):"";
$qry = "select * from `costomer`";
$qry .= "where `passport_no` like '".$search."'";
$res = mysqli_fetch_row(mysqli_query($con,$qry));
```
The passport search term is concatenated into the `LIKE` clause without escaping. Any anonymous visitor can use UNION-based payloads to read arbitrary data from the database - the page prints the injected columns directly into the HTML table (image, name, father name, visa status), e.g. `' union select 1,'IMG',2,'NAME',3,'FATHER',4,'VISASTAT',5,6,...,28-- -` renders attacker-chosen values, which can be replaced with `username,password` from the `admin` table or any other table content.
|
|---|
| Fonte | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/9 |
|---|
| Utilizador | Weaster (UID 102044) |
|---|
| Submissão | 11/10/2026 15h46 (há 16 dias) |
|---|
| Moderação | 27/10/2026 10h01 (16 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 427081 [oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 traceapplication.php search Injeção SQL] |
|---|
| Pontos | 20 |
|---|