CVE-2023-50862 is a critical unauthenticated SQL injection in Kashipara Travel Website 1.0, scored 9.8. The hotelIDHidden parameter of booking.php reaches the database unfiltered. The advisory says no patch is available, so do not run this software on a public server.
What's affected
The record names Kashipara Travel Website 1.0. It says multiple unauthenticated SQL injection flaws exist and that the hotelIDHidden parameter of the booking.php resource is not validated before reaching the database. It was published on 2024-01-04.
NVD scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The researcher advisory agrees on score and rating, and covers CVE-2023-50862 through CVE-2023-50867, which affect other parameters such as hotelId, city and username.
The advisory lists the vendor as contacted on 3 January 2024 and states there is currently no patch available. It also says an exploit is available. Do not wait for a vendor fix.
How to check if you're exposed
Find out whether you run this software. Look for a Travel Website project from Kashipara in your web roots, and search for the file name:
find /var/www -name booking.php 2>/dev/null
If you find it, check whether the site is reachable from the internet. A demo or student project left on a public server counts.
Look at web server logs for odd requests to booking.php, and at the database for unexpected accounts or changed records. The code looks like a free project download, so check that nobody in your organization installed it for a pilot.
What to do now
- Search your web servers for the Kashipara Travel Website project.
- Take any instance offline or restrict it to a private network until it is fixed.
- Rewrite database access with parameterized queries before running it again, or replace the application.
- Review web and database logs for suspicious activity and reset any exposed credentials.
- Run a dependency and code scan on similar sample applications before deploying them.
Why it matters
The weakness is SQL injection, CWE-89. User input is concatenated into a database query, so the input can change what the query does. With no login needed, anyone who can reach the page can try.
Sample and tutorial projects often skip input validation and parameterized queries, because they are written to teach a flow, not to face the internet. The danger comes when they are deployed unchanged.
The record shows no CISA Known Exploited Vulnerabilities listing. The advisory states an exploit is available, which is a different claim from observed attacks.
Quick check
Is there a patch for CVE-2023-50862?
No. The advisory says no patch is available. Remove the software from public servers or fix the queries yourself.
Is this the only injection point?
No. The advisory covers several related CVEs affecting other parameters, from CVE-2023-50862 through CVE-2023-50867.
Sources
Last reviewed: 19 October 2026.
