Executive brief
The Online Resort Management System, a web application used for managing resort bookings and room inventory, contains a security flaw in its administrative interface. An attacker with administrative credentials can exploit this vulnerability to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive business information, including customer data and system configurations.
Technical details
A SQL injection vulnerability exists in Sourcecodester Online Resort Management System v1.0 within the 'id' parameter of the /orms/admin/rooms/manage_room.php component. The application fails to properly sanitize user-supplied input before incorporating it into a database query. An authenticated attacker with high privileges (admin) can send a specially crafted GET request containing a UNION-based SQL payload to extract sensitive information from the database, such as the database name or other table data. The vulnerability is confirmed in environments running PHP 8.1 via XAMPP. No official patch has been identified in the advisory.
Affected products
- Sourcecodester Online Resort Management System 1.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory