Executive brief
The Hotel and Tourism Reservation System, a software platform used for managing guest bookings, contains a security flaw that could allow unauthorized access to its database. By sending a specially crafted web request, an attacker can bypass security measures to view, modify, or delete sensitive information. This could lead to the exposure of customer data or disruption of the reservation service.
Technical details
A SQL injection vulnerability exists in code-projects Hotel and Tourism Reservation System 1.0 within the 'details.php' component. The issue stems from improper neutralization of special elements used in a SQL command, specifically affecting the 'room' argument. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP request to the vulnerable endpoint. Successful exploitation allows the attacker to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data retrieval, modification, or administrative access. A public exploit has been disclosed for this vulnerability.
Affected products
- code-projects Hotel and Tourism Reservation System 1.0
Timeline
- 2026-06-05: disclosed: Public disclosure of the vulnerability and exploit code.
- 2026-06-05: advisory: NVD published the CVE record.