Description
A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument account_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Published: 2026-03-23
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Patch
AI Analysis

Impact

The vulnerability resides in the admin user management module of the Free Hotel Reservation System 1.0. An attacker can manipulate the account_id query parameter in the /hotel/admin/mod_users/index.php?view=edit&id=8 endpoint, causing arbitrary SQL statements to be executed against the underlying database. This flaw is classified as a classic injection vulnerability, corresponding to CWE‑74 and CWE‑89, and enables remote attackers to read, modify, or delete sensitive data stored in the system database.

Affected Systems

The affected product is itsourcecode’s Free Hotel Reservation System version 1.0, specifically the hotel administration module located in the /hotel/admin directory. The vulnerability is known to affect only this version and the component listed; no other versions or components are currently known to be vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity, reflecting the potential for unauthorized data access and modification. Exploit probability data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers with network access to the application can supply a crafted account_id value to inject SQL, making the vulnerability remotely exploitable from the public internet.

Generated by OpenCVE AI on March 24, 2026 at 04:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade the Free Hotel Reservation System to a validated, non‑vulnerable version.
  • If no patch is available, sanitize the account_id parameter by validating its data type and using prepared statements or parameterized queries.
  • Restrict the database credentials used by the web application to the minimum privileges required for normal operations.
  • Monitor database logs for unexpected or repeated injection attempts.
  • Conduct a review of the application code to identify and remediate any other potential injection points.

Generated by OpenCVE AI on March 24, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 24 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 24 Mar 2026 02:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument account_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Title itsourcecode Free Hotel Reservation System Parameter index.php sql injection
First Time appeared Itsourcecode
Itsourcecode free Hotel Reservation System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:free_hotel_reservation_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode free Hotel Reservation System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Free Hotel Reservation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-24T13:42:58.804Z

Reserved: 2026-03-23T05:45:14.406Z

Link: CVE-2026-4612

cve-icon Vulnrichment

Updated: 2026-03-24T13:42:54.917Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-23T22:16:31.677

Modified: 2026-03-24T15:53:48.067

Link: CVE-2026-4612

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T20:36:16Z

Weaknesses