| Title | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection |
|---|
| Description | The affected component is `admin/insert.php`. All insertion handlers concatenate POST parameters directly into `INSERT` statements:
```php
$sql="insert into payment(costomer_id,payment_type,amount,description,inserted_by)
values($costomer_id,'$payment_type','$amount','$description',$user)";
$sql="insert into costomer (uploadimage, full_name, ..., visa_no, inserted_by)
values('$uploadimage', '$full_name', ..., 'visa_no', '$user')";
```
Handlers exist for the `costomer`, `payment`, `ticket`, `daily_expenditure`, `document` and `salary` tables, all interpolating raw POST values. Because `session.php` only redirects without exiting, the endpoint is reachable without authentication (the `inserted_by` column is `varchar`, so the empty session user is accepted). By closing the quoted value and appending another tuple, an attacker inserts arbitrary extra rows with one request - e.g. a crafted `description` value inserts a second fabricated payment record, or fabricated ticket/expenditure/salary rows that distort financial reports.
|
|---|
| Source | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/5 |
|---|
| User | Smartiesxum (UID 102012) |
|---|
| Submission | 10/09/2026 12:01 (24 days ago) |
|---|
| Moderation | 10/21/2026 20:29 (12 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424945 [oretnom23 php-travel-agency-system Insertion admin/insert.php sql injection] |
|---|
| Points | 20 |
|---|