A SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System 1.0 in the /add_query_reserve.php file. The flaw allows remote attackers to manipulate the room_id parameter, potentially leading to unauthorized data access or modification. The vulnerability has a high severity score of 7.3 and public exploit code is available.