The vulnerability in itsourcecode Free Hotel Reservation System 1.0 is due to insufficient validation of the 'image' parameter in the admin module for adding amenities. This allows an attacker with high privileges to remotely upload arbitrary files, potentially leading to further compromise. The CVSS 4.0 base score is 5.1, reflecting medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No vendor patch or official fix information is provided in the available data.

Successful exploitation allows an attacker with administrative privileges to upload arbitrary files remotely, which could lead to unauthorized code execution or system compromise depending on the uploaded content and server configuration. The impact is limited by the requirement for high privileges and the low overall impact scores on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious file uploads in the affected module. Avoid exposing the vulnerable endpoint to untrusted networks.