This vulnerability in SourceCodester Hotel Management System 1.0 involves SQL injection via the room_type parameter in the /index.php/reservation/check endpoint. An attacker can remotely manipulate this parameter to execute unauthorized SQL commands against the backend database. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been published by the vendor as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact on confidentiality, integrity, and availability is rated as low, but the vulnerability still poses a risk of data compromise or disruption of reservation functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the room_type parameter. Input validation and parameterized queries should be applied if possible. Monitor for updates from the vendor regarding patches or official mitigations.