CVE-2024-0884 is a medium severity (CVSS 4.7) SQL injection in SourceCodester Online Tours and Travels Management System 1.0, in payment.php through the id argument. The record names no fix. Use parameterised queries and keep the application off the internet.
What's affected
SourceCodester Online Tours and Travels Management System 1.0. The affected function is exec in payment.php, and the id argument is the injection point. The record says remote attack is possible and an exploit has been disclosed.
No fixed version is listed. Treat it as code you maintain yourself.
The record classifies the weakness as CWE-89 (SQL injection). NVD scores it 4.7 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
The description calls the issue critical, while NVD scores it 4.7 (Medium). This is a sibling of CVE-2024-0883 in the same product, in a different file.
How to check if you're exposed
There is no package manager command that answers this one, because the record points to a standalone application or a product that publishes no version history. Start with an inventory question: do you run Online Tours and Travels Management System anywhere, including test servers, lab machines and forgotten demo installs?
If you build software from source, search your repositories and artifact stores for the project name. The free in-browser dependency scan can flag known issues in the dependencies it finds, which helps when the component is vendored or pulled in transitively.
What to do now
- Find installs of this application and take any exposed ones offline.
- Replace concatenated SQL in payment.php, and search the codebase for the same pattern in other files.
- Bind id as an integer parameter and validate it before use.
- Use a database account without rights to other schemas.
Why it matters
SQL injection (CWE-89) is a recurring issue in this product because the same coding pattern appears in several files. Fixing one file leaves the others, so search for the pattern across the code.
A payment page is also sensitive for what it touches, so database permissions deserve a review.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Is this the same bug as CVE-2024-0883?
Same class and product, different file and function. Fix both and search for more.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
