The vulnerability is an SQL injection flaw located in the /orms/admin/reservations/view_details.php page of Sourcecodester Online Resort Management System v1.0. Because the application does not properly sanitize user input before embedding it into a database query, an attacker who can send a crafted request may cause the database to execute unintended SQL statements. The weakness matches CWE‑89: Improper Neutralization of Special Elements Used in an SQL Command and could potentially expose or modify data stored in the system.

Only the 1.0 release of Sourcecodester Online Resort Management System is known to be affected. The flaw exists specifically in the administrative reservations view endpoint, so installations that expose that URL are at risk. No other versions or products are mentioned as affected.

The CVSS score of 2.7 indicates a low overall severity, reflecting limited impact and a modest audience. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a publicly reachable web request to /orms/admin/reservations/view_details.php. An attacker who can reach the endpoint could inject SQL commands if no defensive controls are in place; the exact scope of compromise would depend on the database permissions granted to the application.