Description
A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controller.php?action=add. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-03-09
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential Remote Code Execution via unrestricted file upload
Action: Apply Patch
AI Analysis

Impact

The flaw allows an attacker to upload any file type, including executable code, through the image parameter in the doInsert function of controller.php. This lack of file type validation (CWE-434) and improper authorization controls (CWE-284) can enable the attacker to place malicious files on the server, potentially leading to remote code execution or other serious compromise. The vulnerability is publicly documented and demonstrated to be reachable remotely.

Affected Systems

The affected products are SourceCodester Resort Reservation System version 1.0 and janobe Resort Reservation System version 1.0. Both are under the same code base and share the same vulnerability.

Risk and Exploitability

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score is less than 1%, suggesting that hardware or software exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack requires remote manipulation of the image argument but does not mention authentication, implying that an unauthenticated attacker could exploit the issue. Hence, while the risk is moderate, the overall exploitation probability is low.

Generated by OpenCVE AI on April 17, 2026 at 11:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of the Resort Reservation System that enforces file type validation and size limits.
  • Restrict upload functionality to authenticated users only, ensuring proper authorization checks before accepting files.
  • Implement strict file type checks on the server side to allow only approved formats (e.g., JPEG, PNG) and block executables.

Generated by OpenCVE AI on April 17, 2026 at 11:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Janobe
Janobe resort Reservation System
Sourcecodester
Sourcecodester resort Reservation System
Vendors & Products Janobe
Janobe resort Reservation System
Sourcecodester
Sourcecodester resort Reservation System

Mon, 09 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Oretnom23
Oretnom23 resort Reservation System
CPEs cpe:2.3:a:oretnom23:resort_reservation_system:1.0:*:*:*:*:*:*:*
Vendors & Products Oretnom23
Oretnom23 resort Reservation System

Mon, 09 Mar 2026 04:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controller.php?action=add. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Title SourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted upload
Weaknesses CWE-284
CWE-434
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Janobe Resort Reservation System
Oretnom23 Resort Reservation System
Sourcecodester Resort Reservation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-10T16:01:10.265Z

Reserved: 2026-03-08T12:36:53.759Z

Link: CVE-2026-3800

cve-icon Vulnrichment

Updated: 2026-03-10T16:01:06.230Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-09T04:16:05.770

Modified: 2026-03-09T15:03:49.280

Link: CVE-2026-3800

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T12:00:11Z

Weaknesses