The flaw resides in the reservation check endpoint, where the room_type parameter can be crafted to inject arbitrary SQL statements. This permits attackers to read, alter, or delete data stored in the underlying database, potentially exposing sensitive guest information or compromising booking logic. The vulnerability is triggered by user input, so it can be exercised without any special privileges.

The issue affects SourceCodester Hotel Management System version 1.0. No other affected versions are documented in the available data.

The CVSS score of 6.9 classifies the flaw as medium severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog, but the remote nature of the attack vector increases its practicality. An attacker can leverage the exposed input to execute SQL commands, making diligent remediation a priority.