A vulnerability marked as critical has been reported in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument account_id leads to sql injection.
This vulnerability is referenced as CVE-2026-4612. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
