A vulnerability exists in the admin login page of the Free Hotel Reservation System where the email field is not appropriately validated, allowing attackers to inject arbitrary SQL commands. This flaw permits the compromise of the database’s confidentiality and integrity, enabling unauthorized read, modification, or deletion of data. The weakness arises from improper input handling typical of input‑dropped injection flaws.

The issue affects the 1.0 release of the Free Hotel Reservation System produced by itsourcecode. The vulnerable code resides in the /hotel/admin/login.php file and is present in installations that have not applied a newer version. Users running this specific version remain exposed.

The CVSS score of 6.9 indicates moderate severity, yet the flaw can be exploited from a remote location. A publicly available exploit has been released, suggesting active exploitation attempts. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the combination of remote accessibility and public exploit elevates real‑world risk.