Description
A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Published: 2026-03-26
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The flaw lies in an unfiltered parameter within the administrative interface, specifically the ID argument of /admin/mod_amenities/index.php?view=editpic. By supplying a crafted value, an attacker can inject arbitrary SQL commands. The injected code could expose, modify, or delete sensitive reservation data. The vulnerability is exploitable from the Internet without any pre‑existing credentials.

Affected Systems

The affected application is itsourcecode Free Hotel Reservation System, version 1.0. The specific component impacted is the administrative file mentioned above. Users running this version with default configurations are exposed to the risk.

Risk and Exploitability

The CVSS score of 5.3 places the issue in the moderate severity range. EPSS data is not available, so the exploitation probability remains uncertain, but the presence of a publicly available exploit script increases the likelihood of real‑world attacks. The vulnerability is not listed in CISA's KEV catalog, yet attackers can reach it remotely by sending a crafted HTTP request to the vulnerable endpoint.

Generated by OpenCVE AI on March 26, 2026 at 15:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest version of Free Hotel Reservation System when a patch is released.
  • If a patch is unavailable, restrict input to numeric values for the affected ID parameter using server‑side validation.
  • Consider applying a web application firewall rule to block typical SQL injection patterns on the /admin/mod_amenities/index.php endpoint.
  • Enable detailed logging for database access and monitor for anomalous queries.
  • Keep the underlying database software current and limit database user privileges to the minimum required for the application.

Generated by OpenCVE AI on March 26, 2026 at 15:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Title itsourcecode Free Hotel Reservation System index.php sql injection
First Time appeared Itsourcecode
Itsourcecode free Hotel Reservation System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:free_hotel_reservation_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode free Hotel Reservation System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Free Hotel Reservation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-26T13:58:15.118Z

Reserved: 2026-03-26T06:09:34.199Z

Link: CVE-2026-4876

cve-icon Vulnrichment

Updated: 2026-03-26T13:58:10.816Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-26T14:16:14.267

Modified: 2026-03-30T13:26:50.827

Link: CVE-2026-4876

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-27T09:28:23Z

Weaknesses