CVE-2026-3730 - Vulnerability Analysis

Overview

itsourcecode Free Hotel Reservation System 1.0 contains a SQL injection caused by manipulation of "amen_id" or "rmtype_id" arguments in /hotel/admin/mod_amenities/index.php?view=edit, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version.

References

• https://itsourcecode.com/
• https://vuldb.com/?ctiid.349708
• https://vuldb.com/?id.349708
• https://vuldb.com/?submit.767010
• https://vuldb.com/?submit.767385
• https://github.com/anon387tdug/anon387/issues/1
• https://github.com/yihaofuweng/cve/issues/62

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner