Which versions of PHP are affected by CVE-2026-6142?

The tushar-2223 Hotel Management System contains an unauthenticated SQL injection vulnerability in the room deletion function that allows attackers to directly manipulate database queries and access,…

Is there a public PoC exploit available for CVE-2026-6142?

Yes, a public proof-of-concept exploit is available for CVE-2026-6142. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6142?

Within 24 hours: Audit deployment inventory to identify all instances of tushar-2223 Hotel Management System and isolate affected systems from internet-facing access; apply network-level restrictions to /admin/roomdelete.php endpoint. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the ID parameter; conduct database access logs review for unauthorized query activity since deployment. Within 30 days: Evaluate migration to actively maintained hotel management software or fork the project with security patches applied; if continued use is required, engage a security contractor to perform input validation remediation on the vulnerable endpoint.

PHP CVE-2026-6142

Q: What is the CVSS score of CVE-2026-6142?

CVE-2026-6142 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21770 MEDIUM

SQL Injection (CWE-89)

2026-04-13 VulDB

PHP SQLi Hotel Management System

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 13, 2026 - 01:22 NVD

HIGH MEDIUM

CVSS changed

Apr 13, 2026 - 01:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 01:18 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 01:15 euvd

EUVD-2026-21770

Analysis Generated

Apr 13, 2026 - 01:15 vuln.today

CVE Published

Apr 13, 2026 - 01:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in tushar-2223 Hotel Management System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. Affected by this vulnerability is an unknown functionality of the file /admin/roomdelete.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in tushar-2223 Hotel Management System /admin/roomdelete.php allows unauthenticated remote attackers to manipulate database queries via the ID parameter, potentially compromising confidentiality, integrity, and availability of hotel management data. Publicly available exploit code exists (CVSS 7.3, EPSS not provided). The vulnerability affects all versions up to commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 in this rolling-release project, and the maintainer has not responded to responsible disclosure attempts.

Technical ContextAI

This is a classic SQL injection (CWE-89) vulnerability in a PHP-based hotel management application. The /admin/roomdelete.php endpoint fails to properly sanitize the ID parameter before incorporating it into SQL queries. SQL injection occurs when user-controlled input is directly concatenated into SQL statements without parameterization or escaping, allowing attackers to inject arbitrary SQL commands. In PHP applications, this typically manifests through inadequate use of prepared statements or missing input validation on parameters passed via GET/POST requests. The vulnerability exists in tushar-2223's Hotel Management System, an open-source project hosted on GitHub that appears to lack security-focused development practices.

RemediationAI

No vendor-released patch identified at time of analysis. The maintainer was notified via GitHub issue #15 but has not responded or released a fix (RL:X - Remediation Level not defined indicates no official patch). Users should immediately implement workarounds: restrict network access to /admin/roomdelete.php to trusted IP addresses only via web server configuration (Apache .htaccess or Nginx location blocks), implement web application firewall rules to block SQL injection patterns in the ID parameter, or disable the room deletion functionality entirely until a patch is available. Organizations should consider migrating to actively maintained hotel management solutions with security-focused development practices. Monitor the GitHub repository at github.com/tushar-2223/Hotel-Management-System for future security updates. Reference the vulnerability disclosure at vuldb.com/vuln/357006 and exploit analysis at the GitHub Gist linked in references for technical details needed to craft WAF rules.