Which versions of Hotel and Tourism Reservation System are affected by CVE-2026-11342?

The Hotel and Tourism Reservation System (code-projects v1.0) contains a critical SQL injection vulnerability allowing unauthenticated remote attackers to access and manipulate hotel reservation data…

Is there a public PoC exploit available for CVE-2026-11342?

Yes, a public proof-of-concept exploit is available for CVE-2026-11342. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11342?

Within 24 hours: Identify and isolate all internet-facing instances of code-projects Hotel and Tourism Reservation System 1.0; restrict network access. Within 7 days: Deploy WAF rules to block SQL injection patterns in the /details.php 'room' parameter; audit database logs for unauthorized access. Within 30 days: Coordinate with vendor for patched release or migrate to an alternative reservation system; conduct data audit and restoration if compromise is confirmed.

Hotel and Tourism Reservation System CVE-2026-11342

Q: What is the CVSS score of CVE-2026-11342?

CVE-2026-11342 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34864 MEDIUM

SQL Injection (CWE-89)

2026-06-05 VulDB

GHSA-h9q5-44xj-9xmq

PHP SQLi Hotel And Tourism Reservation System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 18:22 NVD

HIGH MEDIUM

CVSS changed

Jun 05, 2026 - 18:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 17:51 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to manipulate the 'room' parameter of /details.php to inject arbitrary SQL queries. Publicly available exploit code exists (published via GitHub by researcher and indexed by VulDB), increasing the likelihood of opportunistic exploitation against exposed instances. The flaw is reachable over the network with no privileges or user interaction, making any internet-facing deployment of this PHP application a viable target.

Technical ContextAI

The affected software is a PHP-based hotel and tourism reservation web application distributed by code-projects (CPE: cpe:2.3:a:code-projects:hotel_and_tourism_reservation_system). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the 'room' GET/POST parameter passed to /details.php is concatenated into a SQL query without parameterization or proper escaping. This class of bug typically arises in PHP code that uses mysqli_query or the deprecated mysql_query against user-supplied input, allowing tautology-based authentication bypass, UNION-based data extraction, or time-based blind injection depending on the query context.

RemediationAI

No vendor-released patch identified at time of analysis - the references point only to VulDB advisory entries (https://vuldb.com/vuln/368883) and a third-party PoC at https://github.com/khanfyhhfgfe-cmyk/ht-sql/blob/main/ht_sql.md, with no fix commit or new release published by code-projects. Operators should immediately remove internet exposure of /details.php or take the application offline if it is in production, since code-projects software is typically distributed as educational source code. As a code-level fix, replace the dynamic query construction in /details.php with prepared statements using mysqli or PDO with parameter binding for the 'room' argument, and add server-side type validation (e.g., intval if 'room' is numeric). Compensating controls include placing the application behind a WAF with SQLi signatures targeting the 'room' parameter (low false-positive risk given a single endpoint, but may break legitimate non-numeric inputs), enforcing least-privilege database accounts that lack FILE and CREATE privileges (mitigates pivot to RCE via INTO OUTFILE but won't stop data theft), and enabling verbose query logging for forensic visibility (storage overhead trade-off).