CVE-2026-36938
SQL Injection in Sourcecodester Resort Management Room Module
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | online_resort_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Sourcecodester Online Resort Management System v1.0 is an SQL injection found in the file /orms/admin/rooms/view_room.php.
SQL injection is a type of security flaw where an attacker can insert or manipulate SQL queries by injecting malicious input, potentially allowing unauthorized access to the database.
How can this vulnerability impact me? :
This SQL injection vulnerability can allow an attacker to access, modify, or delete data in the database without authorization.
It may lead to data breaches, loss of data integrity, unauthorized data disclosure, or even full system compromise depending on the database privileges.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Sourcecodester Online Resort Management System v1.0 allows attackers to extract sensitive database information and potentially manipulate data without authorization.
Such unauthorized access and data leakage can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access or breaches.
Therefore, this vulnerability poses a risk to compliance with these common standards and regulations by potentially exposing confidential data and violating requirements for data security and privacy.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This SQL injection vulnerability can be detected by sending crafted HTTP GET requests to the vulnerable endpoint and observing the response for signs of SQL injection.
Specifically, you can test the `id` parameter in the URL `/orms/admin/?page=rooms/view_room&id=` by injecting SQL payloads such as:
- /orms/admin/?page=rooms/view_room&id=-1' union select 1,database(),3,4,5,6,7,8,9,10--+
If the response contains the current database name or other unexpected data, it indicates the presence of the SQL injection vulnerability.
You can use command-line tools like curl to send such requests, for example:
- curl "http://target/orms/admin/?page=rooms/view_room&id=-1' union select 1,database(),3,4,5,6,7,8,9,10--+" -H "Cookie: PHPSESSID=your_session_id"
Replace `http://target` with your target system's address and include any necessary session cookies or headers to authenticate if required.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL injection vulnerability in the Online Resort Management System v1.0, immediate steps include sanitizing and validating the 'id' parameter in the /orms/admin/rooms/view_room.php endpoint to prevent injection of arbitrary SQL commands.
Implement prepared statements or parameterized queries in the code handling the 'id' parameter to ensure that user input cannot alter the intended SQL query structure.
Restrict database permissions to limit the impact of any potential injection, ensuring the database user has only the necessary privileges.
Monitor and review web server logs for suspicious requests targeting the vulnerable endpoint.
If possible, apply any available patches or updates from the vendor or source code repository that address this vulnerability.