This vulnerability in code-projects Hotel and Tourism Reservation 1.0 involves SQL injection via the 'delete' argument in the /admin/rooms.php file's Room Management Page component. An attacker can remotely exploit this flaw to execute unauthorized SQL commands against the backend database. The vulnerability is confirmed public with no official remediation or patch available as of the published date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification in the affected application's database. The impact is rated medium, reflecting limited but significant risk due to the ability to execute arbitrary SQL commands remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, restricting access to the /admin/rooms.php page and validating or sanitizing input parameters such as 'delete' can reduce exposure.