The exploit targets the /admin/roomdelete.php script, where manipulating the ID argument results in SQL injection. The vulnerability allows an attacker to inject arbitrary SQL code remotely using a crafted HTTP request. This can lead to unauthorized reading, modification, or deletion of room records, and potentially other data within the system’s database. The related weakness is identified as CWE‑74 (SQL Injection) and CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command).

The affected product is the Hotel Management System developed by tushar-2223. No specific release identifiers are provided because the project uses a rolling release model without versioned releases at the time of the advisory. As such, any current deployment of the system that has not applied a future fix remains vulnerable.

The assessed CVSS score is 6.9, indicating a moderate to high risk profile. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. The underlying attack vector is inferred to be remote, via HTTP(s) requests to the vulnerable endpoint, and an exploit is already publicly available, implying a non‑negligible likelihood that attackers could leverage this weakness in the wild.