The vulnerability CVE-2026-13552 affects itsourcecode Online Hotel Management System version 1.0. It is a SQL injection flaw in the /admin/mod_amenities/controller.php?action=edit endpoint, where the amen_id parameter is not properly sanitized. This allows remote attackers to inject malicious SQL code, potentially compromising the database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impacts. No vendor advisory or patch is currently provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The impact is rated medium due to the limited scope of confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the amen_id parameter to prevent SQL injection. Restricting access to the affected endpoint and monitoring for suspicious activity may also help mitigate risk.