CVE-2026-4876
SQL Injection in itsourcecode Free Hotel Reservation System Admin Module
Publication date: 2026-03-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| itsourcecode | free_hotel_reservation_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4876 is a critical SQL injection vulnerability found in the Free Hotel Reservation System version 1.0, specifically in the file /admin/mod_amenities/index.php with the parameter id in the URL query string (view=editpic&id=1).
The vulnerability occurs because the id parameter is directly used in SQL queries without proper sanitization or validation, allowing attackers to inject malicious SQL code.
This flaw enables attackers to manipulate SQL queries to perform unauthorized database operations such as accessing, modifying, or deleting data.
- Boolean-based blind SQL injection using conditional statements.
- Error-based SQL injection exploiting MySQL 5.6+ features.
- Stacked queries allowing execution of multiple SQL statements.
- Time-based blind SQL injection leveraging delays.
- UNION-based SQL injection to combine results from multiple SELECT statements.
How can this vulnerability impact me? :
This SQL injection vulnerability can have severe impacts including unauthorized access to sensitive data, data tampering, deletion of data, and full system compromise.
Attackers can exploit this flaw remotely to manipulate the backend database, potentially leading to service disruption and loss of data integrity.
The exploitability has been confirmed using tools like sqlmap, which successfully enumerated multiple databases, demonstrating the risk of data leakage and system control.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the vulnerable endpoint `/admin/mod_amenities/index.php` with the parameter `id` in the URL query string (e.g., `view=editpic&id=1`) for SQL injection flaws.
One effective method is to use automated SQL injection testing tools such as sqlmap to probe the endpoint and confirm exploitability.
- Use sqlmap with a command like: sqlmap -u "http://target/admin/mod_amenities/index.php?view=editpic&id=1" --dbs
- Test for Boolean-based blind SQL injection by injecting conditional statements in the `id` parameter.
- Test for error-based SQL injection by injecting payloads that trigger database errors.
- Test for time-based blind SQL injection by injecting payloads such as `SELECT SLEEP(5)` to observe response delays.
- Test for UNION-based SQL injection by injecting UNION SELECT statements to extract data.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing secure coding practices and restricting database access.
- Use prepared statements with parameter binding to separate SQL code from user input.
- Apply strict input validation and filtering to ensure inputs conform to expected formats.
- Minimize database user privileges by avoiding the use of high-privilege accounts such as `root` or `admin` for routine operations.
- Conduct regular security audits to detect and fix vulnerabilities promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Free Hotel Reservation System 1.0 allows attackers to perform unauthorized database operations such as accessing, modifying, or deleting sensitive data. This can lead to sensitive data leakage and data tampering, which directly impacts the confidentiality and integrity of personal and sensitive information.
Such unauthorized access and potential data breaches can result in non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data and mandate strict controls to prevent unauthorized access and data breaches.
Failure to remediate this vulnerability could lead to violations of these regulations, potentially resulting in legal penalties, reputational damage, and loss of trust.