This vulnerability in code-projects Hotel and Tourism Reservation 1.0 involves SQL injection via the 'delete' parameter in the /admin/reservations.php file, specifically within the Reservations Management Page component. An attacker can remotely exploit this flaw without authentication or user interaction, potentially leading to partial compromise of the database confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary SQL commands via the 'delete' parameter, potentially leading to unauthorized data access, modification, or deletion within the affected database. The impact is limited to the confidentiality, integrity, and availability of the database managed by the Reservations Management Page. No further impact details or evidence of exploitation in the wild are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /admin/reservations.php page to trusted administrators only and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'delete' parameter.