CVE-2026-4966
SQL Injection in itsourcecode Hotel Reservation System Admin Module
Publication date: 2026-03-27
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| itsourcecode | free_hotel_reservation_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying secure coding practices and patching the vulnerable code.
- Use prepared statements with parameter binding to separate SQL code from user input.
- Implement strict input validation and filtering to enforce expected formats on the `id` parameter.
- Minimize database user permissions by avoiding high-privilege accounts like root or admin for application connections.
- Conduct regular security audits to detect and fix vulnerabilities promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Free Hotel Reservation System 1.0 allows attackers to perform unauthorized database operations such as accessing, modifying, or deleting sensitive data. This can lead to sensitive data leakage and data tampering.
Such unauthorized access and potential exposure of sensitive personal or health-related data can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data and ensuring data integrity and confidentiality.
Failure to address this vulnerability could result in violations of these regulations due to data breaches or unauthorized data manipulation.
Can you explain this vulnerability to me?
CVE-2026-4966 is a critical SQL injection vulnerability found in the Free Hotel Reservation System version 1.0, specifically in the file /admin/mod_room/index.php accessed via the GET parameter 'id'.
The vulnerability arises because the 'id' parameter is not properly sanitized or validated, allowing attackers to inject malicious SQL code directly into database queries.
This flaw enables attackers to perform unauthorized database operations such as accessing, modifying, or deleting data.
Multiple SQL injection techniques can be used, including boolean-based blind injection, error-based injection, stacked queries, time-based blind injection, and UNION-based injection.
The backend technology includes PHP 5.6.9, Apache 2.4.39, and MySQL 5.6 or higher.
How can this vulnerability impact me? :
This SQL injection vulnerability can have severe impacts including unauthorized access to sensitive data, data tampering, deletion of data, and potential full system compromise.
Attackers can exploit this flaw remotely to disrupt services or manipulate the backend database.
The exploitation can lead to leakage of confidential information, loss of data integrity, and service downtime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability can be detected by testing the SQL injection point in the parameter `id` of the URL `/admin/mod_room/index.php?view=edit&id=...` using SQL injection techniques.
- Use sqlmap tool to automate detection with commands targeting the vulnerable parameter, for example: sqlmap -u "http://target/admin/mod_room/index.php?view=edit&id=1" --dbms=mysql
- Test for Boolean-based blind injection by injecting payloads like: view=edit&id=(SELECT(CASE WHEN (2729=2729) THEN 1 ELSE (SELECT 6214 UNION SELECT 3015) END))
- Test for error-based injection using MySQL functions, e.g.: view=edit&id=1 AND GTID_SUBSET(CONCAT(0x71626b7071,(SELECT(ELT(5997=5997,1))),0x71716a7871),5997)
- Test for time-based blind injection by injecting delays, e.g.: view=edit&id=1; SELECT SLEEP(5) #
- Test for UNION-based injection to extract data, e.g.: view=edit&id=1 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71626b7071,0x6e68626962726779626152656a4b4c674148626944717777765a564e48784b64424a4470684d41,0x71716a7871),NULL,NULL,NULL-- -