Executive brief
The Online Resort Management System, a web application for managing resort bookings, contains a security flaw that could allow an authorized administrator to access sensitive database information. By sending a specially crafted web request, an attacker with administrative credentials can bypass intended data restrictions to view internal database details. While this requires existing high-level access, it could lead to further data exposure or assist in more complex attacks against the system's infrastructure.
Technical details
A SQL injection vulnerability exists in Sourcecodester Online Resort Management System v1.0 within the 'id' parameter of the /orms/admin/reservations/view_details.php endpoint. The application fails to properly sanitize user-supplied input before incorporating it into a SQL query, allowing for UNION-based injection. An attacker with administrative privileges can exploit this to execute arbitrary SQL commands and leak sensitive information from the database, such as the database name or other table contents. The attack is delivered via a GET request and requires the attacker to be authenticated with high privileges (PR:H).
Affected products
- Sourcecodester Online Resort Management System 1.0
Timeline
- 2026-04-13: disclosed: Initial disclosure and CVE assignment
- 2026-04-13: advisory: NVD published the vulnerability details