CVE-2025-9924
📋 TL;DR
CVE-2025-9924 is an SQL injection vulnerability in Travel Management System 1.0's enquiry.php file that allows attackers to manipulate database queries via the t2 parameter. This enables unauthorized data access, modification, or deletion. Organizations using this specific software version are affected.
💻 Affected Systems
- projectworlds Travel Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive travel data, customer information, or administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit disclosed on GitHub with specific payload targeting t2 parameter. SQL injection is well-understood attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Implement workarounds or migrate to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize t2 parameter before processing
Modify enquiry.php to add: $t2 = mysqli_real_escape_string($conn, $_POST['t2']);
Parameterized Query Implementation
allReplace direct SQL concatenation with prepared statements
Replace vulnerable query with: $stmt = $conn->prepare('SELECT * FROM table WHERE column = ?'); $stmt->bind_param('s', $t2);
🧯 If You Can't Patch
- Block external access to /enquiry.php via web application firewall or network ACLs
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test /enquiry.php endpoint with SQL injection payloads in t2 parameter and observe database errors or unexpected responses.Check Version:
Check software version in admin panel or readme files; system identifies as Travel Management System 1.0.Verify Fix Applied:
Attempt SQL injection after implementing fixes; successful fixes should return error messages or no database interaction.📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database query patterns from web application
- Multiple failed parameter manipulation attempts on enquiry.php
Network Indicators:
- POST requests to /enquiry.php with SQL keywords in parameters
- Unusual database port traffic following web requests
SIEM Query:
source="web_logs" AND uri="/enquiry.php" AND (param="t2" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "' OR '")