This vulnerability affects itsourcecode Free Hotel Reservation System 1.0 and involves SQL injection via the email parameter in the /hotel/admin/login.php component. The injection flaw allows remote attackers to execute arbitrary SQL commands by manipulating the email argument without requiring authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low complexity, and no privileges or user interaction needed. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation of this SQL injection vulnerability could allow attackers to access or manipulate the backend database of the affected system. This may lead to unauthorized data disclosure, modification, or deletion within the Free Hotel Reservation System. Since the vulnerability can be exploited remotely without authentication, it poses a significant risk to affected installations. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks. Monitoring for unusual database queries or access patterns may also help detect exploitation attempts. Avoid exposing the vulnerable component to untrusted networks if possible.