A flaw in the Hotel and Tourism Reservation System allows attackers to manipulate the room argument in details.php, producing an SQL injection that can read from or modify the database. This vulnerability is a classic example of CWE‑74 (Invalid Input or Output Filter) and CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command). Successful exploitation would compromise the confidentiality and integrity of sensitive booking data and could allow attackers to alter reservations or access privileged information.

The affected product is code‑projects Hotel and Tourism Reservation System version 1.0. The issue resides in an unknown function within details.php, and no other versions or modules are listed as impacted.

The CVSS score of 6.9 indicates a moderate to high level of risk, while the EPSS score is unavailable, meaning no public data quantifies exploit likelihood. The flaw is exploitable remotely, as the vulnerable parameter is provided by external users. Because the description notes that the exploit has been disclosed publicly, a remote attacker could construct a malicious room value to gain unauthorized database access without needing any authentication.