| Title | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection |
|---|
| Description | The affected component is `admin/delete.php`. Every delete handler concatenates a GET/REQUEST parameter directly into a `DELETE` statement, and the file contains no `session.php` include, so the injections are reachable without authentication:
```php
if(isset($_GET['costomer_id'])) {
$c_id=$_GET['costomer_id'];
$sql="delete from costomer where costomer_id='$_GET[costomer_id]'";
$result=mysqli_query($con,$sql) or die(mysqli_error($con));
... // then cascading deletes on ticket / payment / document / dependent
}
```
The same unescaped concatenation exists for `ticket_id`, `payment_id`, `id` (daily_expenditure), `document_id`, `salary_id`, `emp_id` (`action=Delete`) and `user_id` (`action=Deleteadmin`). A single request such as `delete.php?costomer_id=0' or '1'='1` deletes every row of the `costomer` table and, through the cascading queries, every ticket, payment and document row as well. The same payload against the other parameters wipes the corresponding tables including the `admin` table itself, permanently destroying the application's data.
|
|---|
| Source | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/3 |
|---|
| User | LinJ (UID 102009) |
|---|
| Submission | 10/08/2026 16:42 (14 days ago) |
|---|
| Moderation | 10/21/2026 16:10 (13 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424812 [oretnom23 php-travel-agency-system admin/delete.php sql injection] |
|---|
| Points | 20 |
|---|