CVE-2026-2848 - Vulnerability Details

- SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection

Description

A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

Published: 2026-02-20

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in SourceCodester Simple Responsive Tourism Website 1.0 permits SQL injection through the Registration component’s Username parameter. The weakness is identified as CWE-89 and CWE-74, allowing an attacker to manipulate the SQL query that stores or retrieves user data. Successful exploitation can lead to unauthorized reading or modification of database contents, potentially exposing personal information or enabling further attacks such as credential harvesting.

Affected Systems

SourceCodester Simple Responsive Tourism Website version 1.0, specifically the /classes/Master.php?f=register registration endpoint within the Registration component.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating a moderate risk level, while the EPSS score is less than 1 %, suggesting a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. An attacker could trigger the issue remotely via a web request that supplies a crafted Username value; a published exploit demonstrates that the flaw can be leveraged in practice.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SourceCodester

Simple Responsive Tourism Website

affected

Version	Status	Constraints
`1.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:oretnom23:simple_responsive_tourism_website:1.0:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Oretnom23

Simple Responsive Tourism Website

90%

Version	Status	Scheme	Platform
`1.0`	affected	generic	—

Sourcecodester

Simple Responsive Tourism Website

100%

Version	Status	Scheme	Platform
`1.0`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest vendor patch or upgrade to a version where the registration input is sanitized or parameterized.
If no official fix exists, modify the application to use prepared statements or escape input before embedding it in SQL queries.
Restrict access to the registration endpoint by IP or implement rate limiting to reduce exploitation chances.
Monitor database logs for anomalous queries that may indicate attempted injection attempts.

Generated by OpenCVE AI on April 17, 2026 at 17:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00045.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/anupeng/CVE/issues/1
https://vuldb.com/?ctiid.347084
https://vuldb.com/?id.347084
https://vuldb.com/?submit.753967
https://www.sourcecodester.com/

History

Tue, 24 Feb 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 23 Feb 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Sourcecodester Sourcecodester simple Responsive Tourism Website
Vendors & Products		Sourcecodester Sourcecodester simple Responsive Tourism Website

Fri, 20 Feb 2026 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Oretnom23 Oretnom23 simple Responsive Tourism Website
CPEs		cpe:2.3:a:oretnom23:simple_responsive_tourism_website:1.0:::::::*
Vendors & Products		Oretnom23 Oretnom23 simple Responsive Tourism Website

Fri, 20 Feb 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Title		SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection
Weaknesses		CWE-74 CWE-89
References		https://github.com/anupeng/CVE/issues/1 https://vuldb.com/?ctiid.347084 https://vuldb.com/?id.347084 https://vuldb.com/?submit.753967 https://www.sourcecodester.com/
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Oretnom23 Simple Responsive Tourism Website

Sourcecodester Simple Responsive Tourism Website

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-20T16:02:07.171Z

Updated: 2026-02-24T14:36:07.402Z

Reserved: 2026-02-20T08:03:55.612Z

Link: CVE-2026-2848

Vulnrichment

Updated: 2026-02-24T14:36:03.028Z

NVD

Status : Analyzed

Published: 2026-02-20T17:25:58.250

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2848

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-17T17:30:23Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object