The vulnerability resides in the room_rates.php file of SourceCodester and janobe’s Resort Reservation System 1.0, where the query parameter 'q' is improperly handled, allowing attackers to inject malicious SQL. This flaw enables remote attackers to execute arbitrary SQL statements, potentially exposing, altering, or deleting sensitive reservation data. The weakness aligns with input validation failures (CWE-74) and classic SQL injection (CWE-89).

Vendors SourceCodester and janobe offer the Resort Reservation System, specifically version 1.0. Users running this release are susceptible to exploitation of the unvalidated 'q' argument in room_rates.php.

The CVSS score of 5.3 indicates moderate impact, while an EPSS of less than 1 % suggests low likelihood of exploitation at this point. The vulnerability is not listed in CISA’s KEV catalog, but the public availability of an exploit signifies that it could be used if an attacker finds a foothold. Remote exploitation is feasible, and the attacker’s success depends on the presence of the vulnerable file and the ability to supply arbitrary SQL through the 'q' parameter.