Description

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-06T15:17:24.120Z",
  "pubdate": "2026-09-06T15:17:24.120Z",
  "executiveSummary": "A vulnerability has been identified in the Hotel and Tourism Reservation system (version 1.0) involving the insecure handling of database backup files. The flaw resides within the Database Backup Handler, specifically affecting the file /ht/hotel_db%20(1).sql.\nThis vulnerability is classified as an information disclosure flaw. It allows unauthorized remote actors to retrieve sensitive database contents without requiring prior authentication or administrative privileges.\nThe primary risk is the exposure of the entire database schema and its contents, which typically include administrative credentials, user records, and reservation data. Given that the exploit is currently public, the attack surface is accessible to any remote user with network visibility to the web directory. This poses a critical risk to data confidentiality and systemic integrity.",
  "technicalDetails": "The vulnerability stems from improper access control and directory indexing policies concerning database backup files within the application's file structure. In the Hotel and Tourism Reservation system, the database dump file, identified as /ht/hotel_db%20(1).sql, is stored in a publicly accessible directory path.\nRoot Cause Analysis: The web server configuration lacks directives to deny access to sensitive file extensions or specific backup files located within the web root. Consequently, the file is served with a standard HTTP response when directly requested by a client. Because the file contains raw SQL statements, including table structures, stored procedures, and potentially hashed credentials or cleartext configuration data, it serves as a roadmap for further system compromise.\nExploitation Method: An attacker exploits this by performing a direct HTTP GET request to the known path /ht/hotel_db%20(1).sql. The server, failing to enforce authentication or restrict file access, streams the file content to the attacker. No complex payload or advanced injection technique is required; the vulnerability is triggered via simple directory traversal or direct URI enumeration.\nAttack Flow: 1. Attacker performs reconnaissance to identify the installation directory or uses public knowledge regarding the default file structure of the product. 2. Attacker initiates an HTTP request to the specific file path '/ht/hotel_db%20(1).sql'. 3. The server interprets the request as a valid resource retrieval. 4. The server responds with the contents of the SQL file. 5. The attacker downloads the file, processes the SQL script to reconstruct the database, and extracts sensitive information such as administrator account details or reservation records.\nImpact: The exposure allows for full reconnaissance of the backend database schema. Attackers can leverage the leaked information to facilitate SQL injection, unauthorized authentication via compromised credentials, or the wholesale theft of user data. Since the exploit is public, this requires minimal technical expertise to execute, significantly increasing the probability of successful exploitation in the wild."
}