An unknown function in the file /hotel/admin/mod_amenities/index.php can be manipulated via the amen_id or rmtype_id parameters to perform SQL injection (CWE‑89) caused by improper handling of unvalidated input (CWE‑74). This flaw allows an attacker to send crafted SQL statements to the underlying database, potentially reading, modifying, or deleting reservation data. The vulnerability is exploitable remotely and a public exploit is available, making a compromise of confidential data or service disruption feasible.

The affected product is itsourcecode Free Hotel Reservation System, version 1.0. No other versions or additional products are listed in the CVE data.

The CVSS score is 6.9, indicating medium severity. The EPSS score is less than 1%, suggesting a low current probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote and would require an attacker to construct a malicious URL or form submission targeting the vulnerable admin endpoint, potentially exploiting the function by providing uncontrolled amen_id or rmtype_id values. An exploit could allow unauthorized data exposure or log modification if the database has sufficient privileges. Based on the data provided, no additional exploitation conditions or prerequisites beyond remote access to the admin interface are stated.