Submit #1024621: oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection

The affected components are the admin search pages: `admin/customer_search.php`, `admin/customer_search_doc.php`, `admin/customer_search_payment.php`, `admin/customer_search_ticket.php`, `admin/daily_expenditure_search.php` and `admin/employee_search.php`. All of them concatenate the search keyword into a `LIKE` clause without escaping:

```php
$customer_name=$_POST["customer_name"];
$sql="select*from costomer where full_name like '%$a%' or telephone_no like '%$a%'";
```

```php
$voucher_no=$_POST["voucher_no"];
$sql="select*from daily_expenditure where voucher_no like $a";
```

```php
$emp_name=$_POST["emp_name"];
$sql="select*from employee where emp_name like '$a%'";
```

Because the session check only redirects without exiting, anonymous users can inject. Payloads such as `' or '1'='1` (customer search), `1 or 1=1` (expenditure search) or `' or emp_name like '%` (employee search) return every record of the respective table; UNION-based payloads extract arbitrary data from any table in the `travel_agency` database, including admin credentials.

• Source: ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/7
• User: Weaster (UID 102044)
• Submission: 10/11/2026 15:45 (21 days ago)
• Moderation: 10/27/2026 10:01 (16 days later)
• Status: Accepted
• VulDB entry: 427079 [oretnom23 php-travel-agency-system Admin Search Pages customer_search.php customer_name/voucher_no/emp_name sql injection]
• Points: 20