A flaw in the /admin/add_tour.php page of code-projects Hotel and Tourism Reservation 1.0 allows an attacker to manipulate the delete_image parameter to inject arbitrary SQL code into a query that the application executes. Because this input is not sanitized, the attacker could read, modify, or delete data stored in the database, potentially compromising the confidentiality, integrity, and availability of the booking information and related business data.

The only affected product is code-projects Hotel and Tourism Reservation 1.0. The vulnerability can be triggered by accessing the /admin/add_tour.php endpoint, which is reachable from outside the application network.

The CVSS score of 6.9 places the flaw in the medium severity range. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest that widespread exploitation is unlikely at present, yet the public exploit documentation confirms that an attacker can reach the injection point remotely through the delete_image parameter. The description does not state that authentication is required, so the vulnerability may also be exploitable by unprivileged users if the endpoint is exposed.