CVE-2026-124581: SQL Injection in Airline Reservation System
A vulnerability published to the NVD on 2026-11-09 affects itsourcecode Airline Reservation System 1.0. It is tracked as CVE-2026-124581 with a CVSS score of 7.3 (High).
Technical Details
The NVD record says an unknown function in /admin/manage_flight.php is affected. Manipulating the ID argument causes SQL injection. The attack can be carried out remotely, and the description states that an exploit has been publicly disclosed.
The description excerpt available when this advisory was written was cut off, so check the full NVD entry for the remaining wording.
Affected Products
| Product | Version |
|---|---|
| itsourcecode Airline Reservation System | 1.0 |
Impact
Exploiting SQL injection in an admin PHP script can let an attacker:
- Read or modify reservation and customer records in the backing database
- Bypass authentication logic that relies on database queries
- Potentially escalate further depending on database privileges
This type of project is commonly used as a learning or demo application. If it has been deployed on a public host, treat it as exposed.
Recommended Actions
- Do not run this application on an internet-facing host. Remove it or restrict it to a trusted network.
- Check for a vendor fix. None was referenced in the source data.
- If you must keep it, patch the code to use prepared statements for the
IDparameter and place a WAF in front of it. - Review web and database logs for suspicious requests to
/admin/manage_flight.php.