EUVD-2026-41772
GHSA-5766-68gf-h8q9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin endpoint path implies low-privilege authentication is typical; partial database read/write impact with no scope change beyond the application's own data.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the file /admin/rooms.php of the component Room Management Page. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
AnalysisAI
SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the backend database through the Room Management Page at /admin/rooms.php, where the delete parameter is passed unsanitized into SQL queries. Remote attackers can exploit this to read, modify, or potentially delete database records. Publicly available exploit code exists per the GitHub advisory by anubhavv106, raising the operational risk despite the moderate CVSS 4.0 score of 5.5 and absence of a CISA KEV listing.
Technical ContextAI
The application is a PHP-based hotel and tourism reservation system distributed by code-projects.org as a sample/educational project. The vulnerable component is the Room Management Page served at /admin/rooms.php; the delete parameter, likely used to identify a room record for deletion, is concatenated directly into a SQL query without parameterization or input sanitization. The root cause is classified as CWE-74 (Injection), the parent class of SQL injection, meaning user-controlled input influences the structure of a downstream query. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no special attack requirements or prerequisites beyond network reachability, though the /admin/ path location creates ambiguity about authentication enforcement discussed in risk assessment.
RemediationAI
No vendor-released patch has been identified at time of analysis for code-projects Hotel and Tourism Reservation 1.0, and the project's educational nature makes an official patch unlikely. The primary fix is to replace string-concatenated SQL queries in /admin/rooms.php with PHP PDO or MySQLi prepared statements using bound parameters, eliminating the injection surface entirely. As an immediate compensating control, restrict access to the /admin/ directory via web server configuration (e.g., HTTP Basic Auth or IP allowlist) - this reduces the attack surface if the admin panel currently lacks authentication, though it does not fix the underlying flaw. Deploying a WAF rule to detect and block SQL injection patterns in the delete parameter can serve as a short-term mitigation with the trade-off of potential false positives. The GitHub advisory at https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Hotel-Tourism-Reservation-rooms.php-SQLi.md provides reproduction details useful for verifying any applied fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today