The vulnerability resides in the sourcecodester Online Resort Management System, specifically the view_room.php endpoint. It allows an attacker to inject arbitrary SQL statements into the query used to fetch room data. If exploited, the attacker could read sensitive data, modify or delete records, or potentially gain higher level access depending on database privileges. The weakness aligns with injection flaws as indicated by CWE-89.

Affected users are those running Sourcecodester Online Resort Management System version 1.0. No other product or vendor versions are listed as impacted. The application provides administrative room viewing functionality that is not protected against injection.

The CVSS score of 2.7 indicates a low severity overall, suggesting that the exploit may be limited by required authentication or other constraints not described. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog, implying low current exploitation likelihood. The attack vector appears to be application-level input handling on the specified endpoint; it is inferred that malicious input submitted to the view_room.php script would be used directly in a database query.