An SQL Injection vulnerability exists in the itsourcecode Free Hotel Reservation System 1.0 within the /hotel/admin/mod_reports/index.php file. By manipulating the 'Home' query parameter, an attacker can inject arbitrary SQL code. This flaw allows an attacker to read, modify, or delete sensitive data stored in the system’s database, thereby compromising confidentiality and integrity of reservation information. The weakness corresponds to CWE-74 (Improper Encoding or Escaping of Dynamic Context Content) and CWE-89 (SQL Injection).

The affected product is the itsourcecode Free Hotel Reservation System, version 1.0 (and any unknown code in that release). Users running this version of the application should verify if the vulnerable file /hotel/admin/mod_reports/index.php is present, as it contains the exploitable code.

The vulnerability has a CVSS score of 6.9, indicating a medium severity risk. Its EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is remote, as indicated by the vendor description, and the exploit has been published, implying that attackers may already be using it in the field.