This vulnerability in code-projects Hotel and Tourism Reservation 1.0 allows remote attackers to perform SQL injection via the 'delete' parameter in the /admin/reservations.php component of the Reservations Management Page. The flaw enables unauthorized manipulation of the backend database through crafted input, potentially compromising data integrity and confidentiality. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and was publicly disclosed with no known exploits in the wild at the time of reporting. No official fix or mitigation has been provided by the vendor.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate the backend database, potentially leading to unauthorized data access, modification, or deletion. This could compromise the integrity and confidentiality of reservation data managed by the application. The vulnerability requires no privileges or user interaction and can be triggered remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected administration interface and implement web application firewall rules to detect and block SQL injection attempts targeting the 'delete' parameter in /admin/reservations.php.