Executive brief
Sourcecodester Online Resort Management System, a web application used for managing resort bookings and room inventory, contains a security vulnerability in its administrative interface. An attacker with administrative credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive business information, customer data, or system configurations.
Technical details
A SQL injection vulnerability exists in Sourcecodester Online Resort Management System v1.0 within the 'id' parameter of the /orms/admin/rooms/view_room.php component. The application fails to properly sanitize user-supplied input before incorporating it into a database query. An authenticated attacker with high privileges (administrative access) can exploit this via a specially crafted GET request to execute arbitrary SQL commands. This allows for the extraction of sensitive information from the 'orms_db' database, such as database names and table contents, using UNION-based injection techniques.
Affected products
- Sourcecodester Online Resort Management System 1.0
Timeline
- 2026-04-13: disclosed: Initial disclosure and CVE assignment
- 2026-04-13: advisory: NVD publication date