EUVD-2026-40058
GHSA-4vmx-6mjv-856q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-panel endpoint path implies at least low-privilege session required; C/I/A all Low reflecting partial database read/write with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/mod_users/controller.php?action=add. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
AnalysisAI
SQL injection in itsourcecode Online Hotel Management System 1.0 exposes the admin user-management endpoint to remote database manipulation via the unsanitized Name parameter in /admin/mod_users/controller.php?action=add. The CVSS 4.0 vector assigns no privilege requirement (PR:N) and low complexity (AC:L), though the admin-panel path raises a discrepancy worth verifying - the endpoint may be accessible without authentication if the application does not enforce session controls on admin routes. A public proof-of-concept exploit exists (E:P in the CVSS 4.0 supplemental data), elevating immediate risk despite the absence of a CISA KEV listing.
Technical ContextAI
The affected application is a PHP-based hotel management system distributed by itsourcecode.com, a tutorial and educational code-sharing site. The vulnerable component is a PHP MVC-style controller (controller.php?action=add) responsible for adding admin users, which directly interpolates the Name HTTP parameter into a SQL query without sanitization or parameterization. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., Injection), which encompasses SQL injection as a subclass. No CPE strings were provided in the intelligence data; the affected product is version 1.0 as described. The backend database engine is unspecified but is typical of LAMP-stack PHP applications using MySQL or MariaDB.
RemediationAI
No vendor-released patch has been identified at time of analysis - itsourcecode distributes static tutorial code without a formal patch or release cycle. The primary remediation is to replace direct SQL string interpolation with parameterized queries or prepared statements (e.g., PDO with bindParam in PHP), which eliminates the injection surface entirely. As a compensating control, restrict access to the /admin/ directory using web-server-level authentication (HTTP Basic Auth or IP allowlisting via .htaccess or nginx access rules), which prevents unauthenticated network access to the endpoint regardless of application-layer flaws. Input validation (allowlist for name fields) can reduce attack surface but is not a substitute for parameterized queries. Given the educational nature of the codebase, organizations running this software in any production or semi-production capacity should replace it with a supported, maintained platform. Advisory and PoC details are at https://vuldb.com/vuln/374563 and https://github.com/Hh-176/CVE/issues/6.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today