The vulnerability is a classic time‑based blind SQL injection in the system_page GET parameter of uHotelBooking System's index.php. It allows an unauthenticated attacker to execute arbitrary SQL code, enabling extraction of sensitive database contents. The weakness is identified as CWE‑89 and could compromise the confidentiality of customer data.

This flaw exists in the Hotel‑Booking‑Script uHotelBooking System product. No specific version numbers are listed in the CVE data, so all installed instances of the product are potentially affected.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the field, though the lack of a KEV listing indicates no known active exploitation. Attackers could exploit the vulnerability by sending crafted GET requests to index.php with malicious system_page values over the network, as the vulnerability is unauthenticated and remote.