Online Hotel Management System CVE-2026-13552

Q: What is the CVSS score of CVE-2026-13552?

CVE-2026-13552 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40063 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-29 cna@vuldb.com

GHSA-rchm-vwvf-jh7x

PHP SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

PR:L assigned because the /admin/ path conventionally requires authentication; no confirmed availability impact from SQL injection alone.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 10:33 vuln.today

DescriptionCVE.org

A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/mod_amenities/controller.php?action=edit. Performing a manipulation of the argument amen_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in itsourcecode Online Hotel Management System 1.0 exposes the admin amenities controller to remote database manipulation via the unsanitized amen_id parameter at /admin/mod_amenities/controller.php?action=edit. A publicly available proof-of-concept exploit has been confirmed (CVSS 4.0 E:P modifier; VulDB submission 843569; GitHub issue Hh-176/CVE#3), enabling unauthenticated or low-privileged remote attackers to read, modify, or corrupt hotel management database records. No vendor patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based hotel management system distributed by itsourcecode, an educational code-sharing platform. The vulnerable file /admin/mod_amenities/controller.php processes the amen_id GET/POST parameter when performing amenity record edits (action=edit). CWE-74 (Injection) covers the root cause: user-supplied input is concatenated directly into a SQL query without parameterization or sanitization, allowing an attacker to alter query structure. The tags PHP and SQLi confirm the language and injection class. The endpoint resides under the /admin/ path, raising questions about whether authentication gates access in default deployments, as the CNA-provided CVSS 4.0 vector specifies PR:N (no privileges required).

RemediationAI

No vendor-released patch has been identified at time of analysis; the fix version is not independently confirmed. The primary remediation is to replace dynamic SQL string concatenation in /admin/mod_amenities/controller.php with parameterized queries or prepared statements using PDO or MySQLi, which eliminates the injection surface entirely. As a compensating control, deploy a web application firewall rule to block SQL metacharacters (single quotes, comment sequences, UNION/SELECT keywords) in the amen_id parameter - note this is bypassable with encoding tricks and should not substitute for code-level fixes. Restrict access to the /admin/ path to trusted IP ranges or require strong authentication if not already enforced; this limits the attack surface while the code remains unpatched. Monitor VulDB entry https://vuldb.com/vuln/374560 and the vendor site https://itsourcecode.com/ for patch releases.