The vulnerability exists in version 1.0 of itsourcecode's Free Hotel Reservation System and is triggered by manipulating the 'image' argument in the /admin/mod_amenities/index.php?view=add endpoint. The flaw permits an attacker to upload arbitrary files without any restriction on file type or size, enabling unrestricted file upload. This weakness is classified as improper access control (CWE‑284) and a file upload vulnerability (CWE‑434).

Affected systems are servers running the itsourcecode Free Hotel Reservation System 1.0. The issue is located specifically in the admin/mod_amenities/index.php file when the view parameter is set to 'add', and it involves an unspecified function that validates or processes the image upload.

The CVSS base score for this vulnerability is 5.1, indicating a medium impact. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack can be performed remotely and is publicly disclosed, meaning that a remote attacker can craft a request to upload a file that bypasses the application's normal restrictions. Because the upload is unrestricted, a malicious file could be stored and later accessed through the web interface, potentially compromising the integrity of stored data or providing a vector for further exploitation, although the description does not specify further effects.