Executive brief
A critical security flaw exists in the Hotel and Tourism Reservation System, a platform used for managing hotel bookings and tour reservations. Due to a coding error in the login process, the system incorrectly grants administrative access when an incorrect password is provided. This allows any remote attacker to take full control of the management dashboard, where they can view customer data, modify reservations, or delete system records.
Technical details
An authentication bypass vulnerability exists in 'admin/login.php' of code-projects Hotel and Tourism Reservation System 1.0. The root cause is an inverted conditional check on the return value of the 'password_verify()' function. Specifically, the application logic displays an error message when 'password_verify()' returns true (correct password) and proceeds to initiate a session when it returns false (incorrect password). A remote, unauthenticated attacker can exploit this by submitting a known administrative email address with an arbitrary incorrect password to gain full administrative privileges. A public exploit and proof-of-concept are available.
Affected products
- code-projects Hotel and Tourism Reservation System 1.0
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory