Which versions of PHP are affected by CVE-2026-5551?

CVE-2026-5551 is a critical SQL injection vulnerability in itsourcecode Free Hotel Reservation System 1.0 that allows unauthenticated attackers to compromise database integrity, confidentiality, and…

Is there a public PoC exploit available for CVE-2026-5551?

Yes, a public proof-of-concept exploit is available for CVE-2026-5551. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5551?

Within 24 hours: identify all instances of itsourcecode Free Hotel Reservation System 1.0 in production and air-gap or restrict network access to administrative interfaces (/hotel/admin/login.php). Within 7 days: evaluate replacement with a patched or alternative hotel reservation system; contact vendor for security guidance or workaround availability. Within 30 days: complete migration to a supported, patched alternative or implement Web Application Firewall (WAF) rules blocking SQL injection patterns in the 'email' parameter as a temporary compensating control pending vendor remediation.

PHP CVE-2026-5551

Q: What is the CVSS score of CVE-2026-5551?

CVE-2026-5551 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19050 MEDIUM

SQL Injection (CWE-89)

2026-04-05 VulDB

PHP SQLi Free Hotel Reservation System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 08:30 euvd

EUVD-2026-19050

Analysis Generated

Apr 05, 2026 - 08:30 vuln.today

CVE Published

Apr 05, 2026 - 08:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/login.php of the component Parameter Handler. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in itsourcecode Free Hotel Reservation System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the 'email' parameter in /hotel/admin/login.php. The vulnerability is remotely exploitable with low attack complexity and no user interaction required. Publicly available exploit code exists (confirmed POC on GitHub), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of unauthenticated remote access, public exploit, and impact on confidentiality, integrity, and availability creates moderate-to-high real-world risk for exposed instances.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based hotel reservation management system. The flaw exists in the parameter handling logic of the administrative login component (/hotel/admin/login.php), where user-supplied input from the 'email' field is incorporated into SQL queries without proper sanitization or parameterized query usage. SQL injection occurs when an application constructs database queries by concatenating user input directly into SQL statements, allowing attackers to inject malicious SQL syntax. In this case, manipulating the 'email' parameter enables attackers to break out of the intended query structure and execute arbitrary SQL commands against the backend database. The affected product is identified as itsourcecode Free Hotel Reservation System version 1.0 (CPE: cpe:2.3:a:itsourcecode:free_hotel_reservation_system:1.0). This type of vulnerability is particularly dangerous in authentication contexts, as it may allow complete authentication bypass, extraction of credentials, or privilege escalation without requiring any legitimate access.

RemediationAI

No vendor-released patch has been identified at the time of analysis based on available data. Organizations running Free Hotel Reservation System 1.0 should immediately implement the following compensating controls: First, restrict network access to /hotel/admin/login.php using IP allowlisting, VPN requirements, or web application firewall (WAF) rules to limit exposure to trusted networks only. Second, deploy a WAF with SQL injection detection rules to filter malicious input targeting the 'email' parameter. Third, monitor database and application logs for suspicious authentication attempts and SQL error messages indicating injection attempts. Fourth, consider disabling the administrative interface entirely if not actively needed, or replace the system with a maintained alternative hotel reservation platform that receives security updates. For technical teams with PHP development capability, the underlying code should be modified to use prepared statements or parameterized queries instead of string concatenation for SQL query construction. Contact the vendor (itsourcecode.com) to request a security update or migration guidance. Detailed vulnerability information is available at https://vuldb.com/vuln/355315 and the public exploit is documented at https://github.com/jasonwong666/cve/issues/1.