CVE-2026-13552: itsourcecode Online Hotel Management System controller.php edit sql injection
A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/modamenities/controller.php?action=edit. Performing a manipulation of the argument amenid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13552?
CVE-2026-13552 has a high severity rating of 7.3.
How does CVE-2026-13552 affect the Online Hotel Management System?
CVE-2026-13552 allows for SQL injection through the manipulation of the amen_id parameter in the controller.php file.
Can CVE-2026-13552 be exploited remotely?
Yes, CVE-2026-13552 can be exploited remotely due to its nature as a SQL injection vulnerability.
Which component of the Online Hotel Management System is vulnerable in CVE-2026-13552?
The vulnerability affects the /admin/mod_amenities/controller.php file when the action is set to edit.
How can I mitigate the risk of CVE-2026-13552?
To mitigate CVE-2026-13552, it is recommended to validate and sanitize input parameters in the application.