A PHP-based hotel and tourism reservation system exposes a database backup file named hotel_db (1).sql through an unforeseen function in the Database Backup Handler component, allowing remote attackers to download or view the file contents. This results in the disclosure of potentially sensitive data, such as database structure, usernames, passwords, or other proprietary information. The flaw is classified as an information disclosure, with the associated weaknesses being insufficient access control (CWE-284) and lack of adequate protection of sensitive information (CWE-200).

The affected product is code-projects Hotel and Tourism Reservation in PHP version 1.0. The vulnerability is tied to the backup file located in the /ht/ directory; the file is directly web‑accessible and no patch version is listed in the vendor’s changelog. Any deployment of this application that still includes the exposed backup file is impacted.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, but the exploit is publicly accessible. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the exposed file remotely by requesting the URL that points to the backup file, thereby reading its contents and enabling further reconnaissance or credential theft.