CVE-2026-3736
📋 TL;DR
This CVE describes a SQL injection vulnerability in code-projects Simple Flight Ticket Booking System 1.0. Attackers can manipulate the 'from' parameter in SearchResultRoundtrip.php to execute arbitrary SQL commands. Any organization using this vulnerable software version is affected.
💻 Affected Systems
- code-projects Simple Flight Ticket Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of sensitive customer data (passenger info, payment details), database modification/deletion, and potential server takeover via SQL injection extensions.
Likely Case
Data exfiltration of booking information, passenger details, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Exploit details are publicly available. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch available, implement workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'from' parameter in SearchResultRoundtrip.php
Modify SearchResultRoundtrip.php to validate/sanitize user input before database queries
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL injection patterns in 'from' parameter
🧯 If You Can't Patch
- Isolate the vulnerable system behind a WAF with SQL injection protection rules
- Restrict network access to only necessary IP addresses and implement strict input validation
🔍 How to Verify
Check if Vulnerable:
Test the SearchResultRoundtrip.php endpoint with SQL injection payloads in the 'from' parameterCheck Version:
Check application version in configuration files or admin panelVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts following SQL errors
- Suspicious 'from' parameter values in access logs
Network Indicators:
- Unusual database connection patterns from web server
- Large data transfers from database to external IPs
SIEM Query:
source="web_logs" AND ("SearchResultRoundtrip.php" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE" OR "DROP"))