Executive brief
A security vulnerability exists in the Hotel and Tourism Reservation software, which is used to manage bookings and events for hospitality businesses. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive customer information, reservation data, or administrative credentials, potentially disrupting business operations.
Technical details
A time-based blind SQL injection vulnerability exists in code-projects Hotel and Tourism Reservation 1.0 within the '/admin/add_event.php' file. The vulnerability is located in the 'fdetails' POST parameter of the Event Management Page component. Because the application fails to properly sanitize user input before including it in SQL queries, a remote, unauthenticated attacker can use specially crafted payloads (e.g., using XOR and SLEEP functions) to extract sensitive data from the database. A proof-of-concept exploit has been publicly disclosed, confirming that the vulnerability can be exploited to enumerate database contents. No official patch has been identified, but remediation involves using prepared statements with parameterized queries.
Affected products
- code-projects Hotel and Tourism Reservation 1.0
Timeline
- 2026-07-05: disclosed: Public disclosure of the exploit and vulnerability details.
- 2026-07-05: advisory