CVE-2025-9426 is a high severity (7.3) SQL injection flaw in itsourcecode Online Tour and Travel Management System, affecting version 1.0. No fixed version is confirmed. Until a fix is confirmed, restrict who can reach the web application, review the affected code path, and scan your dependencies.
What's affected
- Product: itsourcecode Online Tour and Travel Management System
- Affected versions: 1.0
- Component:
/package.php - Parameter: the
subcatidparameter - Severity: High, CVSS 7.3 (
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) - Weakness classes: CWE-74, CWE-89
- Fixed version: No fixed version is confirmed, so the vendor advisory or release page should be checked
The NVD description says input to the subcatid parameter is used in a database query without proper handling. It also says the attack can be started remotely and that an exploit has been made public. The record does not list a fixed version, and the reference pages we could reach did not either.
This is a small PHP style web application distributed as source code, so there is usually no package to upgrade. Whoever deployed it owns the code and the fix.
The public report we read describes the same product, file and parameter as the record, so we found no conflict in affected versions or severity between the two. Severity above is the score in the record. The advisory text itself gives no separate score.
How to check if you're exposed
Start by finding out whether the product is on your servers at all. From the host that serves your sites, look for the file named in the record:
find /var/www -type f -name "package.php" 2>/dev/null
If that returns a path, open the application's own version information or the download you installed from and compare it with the affected range (1.0). Many of these projects ship without a version string in the code, so the date you downloaded the source may be the best clue.
Then look at who can reach it. Search your web server log for requests to the file and read the pattern, not just the count:
grep -i "package.php" /var/log/nginx/access.log | tail -n 50
On Apache the log is usually under /var/log/apache2. Look for unusual characters in query strings or form values, repeated requests from one address, and requests outside business hours.
What to do now
- Find it. Work out whether itsourcecode Online Tour and Travel Management System is installed anywhere in your estate, including test servers and old demos.
- Limit exposure. Put the application behind a VPN or an IP allowlist, or take it offline if nobody needs it.
- Look for a fix. Check the vendor's site or repository for a newer release. If none exists, ask the vendor directly and record the answer.
- Close the gap in code if you own it. Change the affected query to use parameterised statements and validate the input type before it reaches the database.
- Watch the logs. Keep web server logs for the affected path and review them for odd input.
- Scan. Run your dependency manifest through the free in-browser dependency scan to see what else is exposed.
Why it matters
SQL injection (CWE-89) happens when text from a request becomes part of a database query instead of staying data. The database cannot tell the difference, so a crafted value can change what the query does. The usual impact is unauthorised reads or changes to stored data, and the record scores confidentiality, integrity and availability impact as low each because the reach depends on the query.
The same pattern shows up again and again in small PHP and Go projects, often across many pages of one application. That is why a single product can carry a dozen near identical CVEs. Fixing one file does not fix the habit. A search for the same unsafe query style across the codebase is the real remediation.
The record shows the CISA Known Exploited Vulnerabilities flag as false, and nothing we read reports use in real attacks. The NVD description does say a proof of concept is public, which lowers the effort for anyone who wants to try it. Treat it as exposed if the product is reachable.
Quick check
Is a patch available?
The record and the report we read name no fixed release, so check the vendor's site for a newer version before assuming you are covered. Check the vendor page again before you act, because this can change.
Does this CVE mean attackers are using it now?
Not according to the sources we read. The CISA KEV flag in the record is false. The NVD description does say an exploit is public, so exposure is still worth treating seriously.
Sources
- NVD record and Safeguard Gold entry for CVE-2025-9426
- Public vulnerability report for this CVE
- Other references in the record, including VulDB, could not be retrieved when we checked.
Last reviewed: 18 October 2026.
