A flaw was identified in itsourcecode Online Hotel Management System 1.0 within the controller.php file handling add actions. The vulnerability resides in an unknown function that processes the image argument, allowing an attacker to manipulate the value and cause an unrestricted upload. This weakness permits the placement of arbitrary files on the server and, if executable files are accepted, could lead to further compromise. The flaw is classified as CWE‑284 and CWE‑434.

The affected product is itsourcecode Online Hotel Management System, version 1.0. Users running this version of the application are at risk, as the vulnerability exists in the admin module that manages amenities. There is no other version information provided, so all deployments of the 1.0 release should be considered vulnerable.

The CVSS score for the vulnerability is 6.9, indicating moderate severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The description confirms that the attack can be launched remotely, and an exploit has been published. While the exact attack vector (authenticated vs. unauthenticated) is not detailed, the reference to a manipulation of the image argument suggests that the functionality is accessible through the web interface, potentially without user authentication. The risk is that attackers can upload malicious files to the server, compromising server integrity and confidentiality.