The vulnerability is a classic SQL injection that occurs when an attacker crafts the Name or Email parameters in an HTTP POST request to the home.php handler. By injecting malicious SQL via these fields, an attacker can read, modify, or delete data in the application database. This flaw can lead to compromised confidentiality and integrity of the stored information and potentially allow privilege escalation if administrative data is exposed.

The flaw affects the tushar-2223 Hotel-Management-System, specifically the home.php component. Because the product follows a continuous delivery model, no specific version numbers are listed; the vulnerability exists in all releases up to commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. Therefore any current installation prior to that commit is potentially vulnerable.

With a CVSS score of 5.3, the vulnerability is considered moderate. The EPSS score is below 1%, indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. However, the vulnerability can be triggered remotely via an HTTP POST request without additional prerequisites, and public exploit code has been released, making it a passive target for automated attacks. The risk is therefore moderate due to the severity, but the likelihood of exploitation remains low at present.