Which versions of Hotel Management System are affected by CVE-2026-7506?

SourceCodester Hotel Management System 1.0 contains an unauthenticated SQL injection vulnerability in the reservation module that allows remote attackers to compromise database confidentiality,…

Is there a public PoC exploit available for CVE-2026-7506?

Yes, a public proof-of-concept exploit is available for CVE-2026-7506. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7506?

Within 24 hours: inventory all instances of SourceCodester Hotel Management System 1.0 in production and development environments; isolate any internet-facing installations behind a Web Application Firewall (WAF) with SQL injection blocking rules. Within 7 days: implement input validation and parameterized query patches at the application layer if vendor patching is not forthcoming; consider deploying a reverse proxy with request filtering for the /index.php/reservation/check endpoint. Within 30 days: evaluate migration to a supported, actively maintained hotel management system or require vendor commitment to security updates before continued use.

Hotel Management System CVE-2026-7506

Q: What is the CVSS score of CVE-2026-7506?

CVE-2026-7506 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

SQL Injection (CWE-89)

2026-04-30 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Severity Changed

Apr 30, 2026 - 23:22 NVD

HIGH MEDIUM

CVSS changed

Apr 30, 2026 - 23:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Apr 30, 2026 - 23:00 vuln.today

Analysis Generated

Apr 30, 2026 - 22:45 vuln.today

CVE Published

Apr 30, 2026 - 22:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in SourceCodester Hotel Management System 1.0. This impacts an unknown function of the file /index.php/reservation/check. Such manipulation of the argument room_type leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Hotel Management System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the room_type parameter in /index.php/reservation/check. CVSS 7.3 indicates medium-to-high severity with confidentiality, integrity, and availability impacts. Publicly available exploit code (GitHub) significantly lowers the barrier to exploitation. EPSS data unavailable, but public POC availability and remote unauthenticated attack vector suggest elevated real-world risk for internet-exposed installations of this PHP-based hotel management system.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP web application. The affected endpoint /index.php/reservation/check processes the room_type parameter without proper input sanitization or parameterized queries, allowing attackers to inject arbitrary SQL commands. CPE identifies the vulnerable product as SourceCodester Hotel Management System version 1.0. SQL injection remains a prevalent and dangerous vulnerability class because it grants direct database access, bypassing application-layer authorization. The CVSS vector AV:N/AC:L/PR:N indicates the vulnerability is remotely exploitable over the network with low complexity and no authentication required, making it accessible to unsophisticated attackers using the publicly available exploit code.

RemediationAI

No vendor-released patch identified at time of analysis. SourceCodester typically publishes code samples rather than maintaining production software with security updates. Primary mitigation: discontinue use of Hotel Management System 1.0 in production environments and replace with actively maintained hotel management software that receives security updates. If continued use is unavoidable, implement SPECIFIC compensating controls: (1) Apply strict input validation on room_type parameter using an allowlist of valid room type values (e.g., 'single', 'double', 'suite')-reject any input containing SQL metacharacters (quotes, semicolons, dashes, comment markers); trade-off is reduced functionality if dynamic room types are required. (2) Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting /index.php/reservation/check, though determined attackers can evade signature-based detection. (3) Restrict application database account permissions to minimum required (SELECT/INSERT only on specific tables, no DROP/ALTER)-limits impact but does not prevent data exfiltration. (4) Deploy intrusion detection monitoring database queries for injection patterns. For developers: refactor code to use parameterized queries/prepared statements with bound parameters (mysqli_prepare or PDO in PHP). References: VulDB 360315 (https://vuldb.com/vuln/360315), exploit POC at https://github.com/wangzhongyang085/CVE/issues/2.