Description
A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /accomodation.php. Such manipulation of the argument q leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Published: 2026-03-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection leading to data exposure
Action: Patch
AI Analysis

Impact

The vulnerability resides in the accommodation.php component of SourceCodester and janobe's Resort Reservation System 1.0. Manipulation of the query string parameter q allows attackers to inject arbitrary SQL statements, leading to unauthorized data access or modification. The flaw can be exploited remotely through a crafted HTTP request.

Affected Systems

The affected product is SourceCodester's Resort Reservation System and janobe's Resort Reservation System, both at version 1.0.

Risk and Exploitability

With a CVSS v3.1 score of 5.3, the vulnerability is considered medium severity. The EPSS score is below 1%, indicating a low likelihood of exploitation at this time, and the issue is not listed in the CISA KEV catalog. Attackers could exploit the vulnerability remotely by supplying a malicious value for the q parameter, potentially gaining unauthorized read or write access to the underlying database. While the probability of exploitation remains low, the potential impact includes data exposure and alteration of reservation records.

Generated by OpenCVE AI on April 16, 2026 at 10:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor's security patch or upgrade to the latest version of the Resort Reservation System when it becomes available.
  • If no patch is offered, modify the accommodation.php code to use prepared statements or otherwise properly escape and validate the q parameter to eliminate injection.
  • Enforce authentication and page access controls so that only authorized users can access the accommodation.php page, thereby limiting the exposure of the vulnerable input.

Generated by OpenCVE AI on April 16, 2026 at 10:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Oretnom23
Oretnom23 resort Reservation System
CPEs cpe:2.3:a:oretnom23:resort_reservation_system:1.0:*:*:*:*:*:*:*
Vendors & Products Oretnom23
Oretnom23 resort Reservation System

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester resort Reservation System
Vendors & Products Sourcecodester
Sourcecodester resort Reservation System

Sun, 08 Mar 2026 21:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /accomodation.php. Such manipulation of the argument q leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Title SourceCodester/janobe Resort Reservation System accomodation.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Oretnom23 Resort Reservation System
Sourcecodester Resort Reservation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-10T20:38:26.221Z

Reserved: 2026-03-07T21:04:09.051Z

Link: CVE-2026-3771

cve-icon Vulnrichment

Updated: 2026-03-10T20:38:23.401Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-08T22:15:48.810

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-3771

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T10:30:16Z

Weaknesses