The vulnerability is a classic SQL injection flaw in the file /orms/admin/activities/manage_activity.php of the Sourcecodester Online Resort Management System. An attacker who can supply crafted input to this endpoint can influence the SQL queries sent to the database, potentially retrieving, modifying, or deleting data. The CVSS score of 2.7 indicates that the impact is limited but not negligible; it could expose sensitive information without elevating privileges or causing a denial of service.

The affected product is Sourcecodester Online Resort Management System version 1.0. No other vendors or versions are listed, and no specific patch notes are provided.

The CVSS base score of 2.7 reflects a low severity issue, and the exploit probability score is not available. The vulnerability is not catalogued in the CISA KEV list. The likely attack vector is a remote web‑based request via the administrative interface, where unsanitized user input can be injected into SQL statements. An adversary exploiting this flaw would need access to the affected endpoint, but no special credentials are required beyond the normal operation of the application.