CVE-2024-0883 is a medium severity (CVSS 6.3) SQL injection in SourceCodester Online Tours and Travels Management System 1.0, in admin/pay.php through the id argument. The record names no fix. Use parameterised queries and keep the application off the internet.
What's affected
SourceCodester Online Tours and Travels Management System 1.0. The affected function is prepare in admin/pay.php, and the id argument is the injection point. The record says it can be attacked remotely and an exploit has been disclosed.
No fixed version is listed. SourceCodester projects are sample code, so the fix is to change the code you run.
The record classifies the weakness as CWE-89 (SQL injection). NVD scores it 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
The description calls the issue critical, VulDB's rating. NVD scores it 6.3 (Medium). The vector requires low privileges, which explains the gap.
How to check if you're exposed
There is no package manager command that answers this one, because the record points to a standalone application or a product that publishes no version history. Start with an inventory question: do you run Online Tours and Travels Management System anywhere, including test servers, lab machines and forgotten demo installs?
If you build software from source, search your repositories and artifact stores for the project name. The free in-browser dependency scan can flag known issues in the dependencies it finds, which helps when the component is vendored or pulled in transitively.
What to do now
- Check whether this application runs anywhere, including class projects on shared hosts.
- Replace string built SQL with prepared statements that bind id as an integer.
- Run the database account with only the permissions the page needs.
- Do not expose the admin directory to the internet.
Why it matters
SQL injection (CWE-89) occurs when input changes the structure of a query. A numeric id that is concatenated into SQL is the classic case, and binding it as a parameter removes the problem.
Sample applications are often copied into real use. Running a code scan over them before deployment catches issues like this.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
Injection flaws like this show up in static analysis. This demo shows how a code scan reports a vulnerable query.
Click through it at your own pace, or open it full screen.
Quick check
Does the word prepare in the record mean it is safe?
No. The function name does not make a query safe. What matters is whether input is bound as a parameter.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
