| Title | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection |
|---|
| Description | The affected component is `admin/update.php`. All nine update handlers concatenate POST parameters directly into `UPDATE` statements:
```php
if($_REQUEST['action']=='updateArtical'){
$sql="update pages set title='$title', description='$description' WHERE page_id='$page_id'";
}
...
$sql="update costomer set full_name='$_POST[full_name]',...,visa_no='$_POST[visa_no]',
date_of_insertion=now(),inserted_by='$user' where costomer_id='$_POST[hiden]'";
```
Handlers exist for the `pages`, `costomer`, `payment`, `ticket`, `dependent`, `document`, `daily_expenditure`, `employee` and `salary` tables, all interpolating raw POST values into both the `SET` clause and the `WHERE` clause. Because `session.php` only redirects without exiting (see the missing-authentication issue), the endpoint is reachable without authentication. A payload such as `page_id=22' or '1'='1` updates every row of the `pages` table in one request; the same technique on the other handlers rewrites arbitrary columns of any table (e.g. customer status fields, payment amounts, salary records).
|
|---|
| Source | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/4 |
|---|
| User | mochi (UID 102011) |
|---|
| Submission | 10/08/2026 16:49 (14 days ago) |
|---|
| Moderation | 10/21/2026 16:10 (13 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424814 [oretnom23 php-travel-agency-system admin/update.php sql injection] |
|---|
| Points | 20 |
|---|