| Title | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 SQL Injection |
|---|
| Description | The affected component is `traceapplication.php`, a fully public page (no session check at all) where visitors trace their visa application by passport number:
```php
$search = isset($_REQUEST['search'])?trim($_REQUEST['search']):"";
$qry = "select * from `costomer`";
$qry .= "where `passport_no` like '".$search."'";
$res = mysqli_fetch_row(mysqli_query($con,$qry));
```
The passport search term is concatenated into the `LIKE` clause without escaping. Any anonymous visitor can use UNION-based payloads to read arbitrary data from the database - the page prints the injected columns directly into the HTML table (image, name, father name, visa status), e.g. `' union select 1,'IMG',2,'NAME',3,'FATHER',4,'VISASTAT',5,6,...,28-- -` renders attacker-chosen values, which can be replaced with `username,password` from the `admin` table or any other table content.
|
|---|
| Source | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/9 |
|---|
| User | Weaster (UID 102044) |
|---|
| Submission | 10/11/2026 15:46 (21 days ago) |
|---|
| Moderation | 10/27/2026 10:01 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427081 [oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 traceapplication.php search sql injection] |
|---|
| Points | 20 |
|---|