A vulnerability in code-projects Simple Online Hotel Reservation System 2.0 allows remote attackers with high privileges to perform unrestricted file uploads via the /admin/edit_room.php component's Photo Handler. This vulnerability has a medium severity score of 4.7 and public exploit code is available.