Executive brief
A security vulnerability exists in the itsourcecode Free Hotel Reservation System, a software package used for managing hotel bookings. An attacker can exploit this flaw to bypass security controls and interact directly with the underlying database. This could lead to the theft of guest information, unauthorized modification of reservation records, or a complete shutdown of the booking service.
Technical details
A SQL injection vulnerability exists in itsourcecode Free Hotel Reservation System 1.0 within the '/hotel/admin/login.php' file. The root cause is the failure of the 'Parameter Handler' component to properly sanitize or validate the 'email' POST parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based blind, error-based, and time-based techniques). Successful exploitation allows for unauthorized database access, sensitive data exfiltration, and potential full system compromise. A public Proof-of-Concept (PoC) using sqlmap has been released.
Affected products
- itsourcecode Free Hotel Reservation System 1.0
Timeline
- 2026-03-19: disclosed: Vulnerability details and PoC shared on GitHub by researchers from Guangzhou University.
- 2026-04-05: advisory: NVD and VulDB published the vulnerability details.