This vulnerability in tushar-2223 Hotel Management System up to commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 allows remote attackers to perform SQL injection via manipulation of the ID argument in /admin/roomdelete.php. The system does not require authentication or user interaction for exploitation, and the vulnerability has low to limited complexity to exploit. The rolling release nature of the product means no fixed version is currently identified, and the vendor has not yet responded or issued a fix.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, no active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing temporary mitigations such as input validation or restricting access to the vulnerable endpoint until an official patch is released.