Listen to this Post
How the CVE Works
The vulnerability in itsourcecode Online Tour and Travel Management System 1.0 stems from improper input sanitization in the `/admin/disapprove_user.php` file. The `ID` parameter is directly concatenated into an SQL query without validation, allowing attackers to inject malicious SQL commands. Remote exploitation is possible, enabling unauthorized database access, data manipulation, or extraction. The exploit leverages classic SQL injection techniques, such as appending UNION-based queries or Boolean-based blind SQLi payloads to the vulnerable parameter.
DailyCVE Form
Platform: itsourcecode Online Tour
Version: 1.0
Vulnerability: SQL Injection
Severity: Medium
Date: 08/18/2025
Prediction: Patch by 09/2025
What Undercode Say
Analytics
SELECT FROM users WHERE id = '[bash]'; UNION SELECT 1,2,3,4,5--
Exploit
GET /admin/disapprove_user.php?ID=1' UNION SELECT 1,user(),3,4-- HTTP/1.1
Protection from this CVE
- Input sanitization
- Prepared statements
- WAF rules
Impact
- Data leakage
- Unauthorized access
- Database compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
