Free Hotel Reservation System CVE-2026-4876

This vulnerability presents moderate but concrete risk despite the CVSS 4.0 score of 5.3. The CVSS vector indicates low attack complexity (AC:L), network reachability (AV:N), and no user interaction required (UI:N), making exploitation straightforward. However, the requirement for authenticated access (PR:L) limits the threat actor pool to individuals with administrator credentials. The SSVC decision framework rates exploitation as 'poc' (publicly available proof-of-concept code exists per GitHub reference), rates the attack as non-automatable at scale, and confirms partial technical impact (VC:L, VI:L, VA:L-partial confidentiality, integrity, and availability impact). EPSS exploitation probability is marked 'E:P' (Probable), suggesting this vulnerability will likely be exploited in the wild against unpatched instances. The presence of a public GitHub PoC combined with low attack complexity creates a realistic attack surface for any organization running this unsupported hotel reservation system. Organizations should treat this as a priority if the system is internet-facing or accessible to untrusted admin users.

An attacker with valid administrator credentials logs into the Free Hotel Reservation System admin panel and navigates to the amenities module. Instead of selecting a legitimate amenity ID, the attacker crafts a malicious URL such as /admin/mod_amenities/index.php?view=editpic&id=1' UNION SELECT user(),database(),version() -- which injects SQL commands into the query. The unsanitized ID parameter is concatenated directly into the SQL query, causing the injected UNION statement to return database metadata, usernames, and version information to the attacker. From there, the attacker can escalate to extracting the admin credentials table, modifying hotel rates, or deleting bookings. A publicly available proof-of-concept on GitHub confirms this attack path is straightforward and requires only standard HTTP tools and basic SQL knowledge.