The vulnerability CVE-2026-5551 affects itsourcecode Free Hotel Reservation System 1.0. It is a SQL injection flaw located in the /hotel/admin/login.php component's parameter handler, specifically through manipulation of the email argument. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official fix or patch has been published by the vendor as of the publication date. Exploit code is publicly available, which may facilitate attacks.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database via the email parameter in the login script. This may lead to unauthorized data access or modification. The impact is rated medium due to limited scope and the absence of elevated privileges or user interaction requirements. There is no evidence of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the email parameter in /hotel/admin/login.php. Additionally, reviewing and sanitizing input handling in the affected component is recommended. Monitor vendor channels for updates and patches.