A flaw exists in the /admin/add_event.php script of the code‑projects Hotel and Tourism Reservation application, where the fdetails parameter is interpolated directly into a database query inject arbitrary SQL statements by manipulating the fdetails value. The injected SQL can read, modify, or delete event data stored in the system, thereby compromising the confidentiality, integrity, and availability of the reservation database. The weakness is classified as a SQL Injection (CWE‑89) and an Implicit Use of Trust (CWE‑74).

The vulnerability is present in the Hotel and Tourism Reservation product from code‑projects, specifically that deploys the /admin/add_event.php page is susceptible. No sub‑version granularity is specified, so the entire 1.0 release is considered at risk.

The CVSS score of 6.9 signals a moderate severity, while the EPSS of <1% indicates a very low probability of exploitation worldwide. The vulnerability is not listed in the CISA KEV catalog, and the attack can be carried out remotely by sending a crafted HTTP request to the admin endpoint. An attacker does not need local system access, merely the ability to target the web server and supply a malicious fdetails payload to inject SQL.