This vulnerability in code-projects Hotel and Tourism Reservation System 1.0 allows remote attackers to perform SQL injection via the 'room' argument in the /details.php file. The injection flaw could enable attackers to manipulate backend SQL queries, potentially compromising data confidentiality or integrity. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or vendor advisory has been published to date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited but non-negligible confidentiality, integrity, and availability consequences. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitoring for unusual database activity may help detect exploitation attempts.