PT-2026-8337 · Tushar 2223 · Hotel Management System

Alexperrakis · Published 2026-02-16 · Updated 2026-02-17 · CVE-2026-2553

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions tushar-2223 Hotel-Management-System versions up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15

Description A security flaw exists in tushar-2223 Hotel-Management-System. The issue is related to SQL injection within the HTTP POST Request Handler component, specifically affecting the file /home.php. Manipulation of the Name/Email argument can trigger the injection. This attack can be initiated remotely. The exploit has been publicly released. Continuous delivery with rolling releases is used, and no specific version details for affected or updated releases are available. The vendor was contacted but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-2553

Affected Products

Hotel Management System

References · 9

• 🔥 https://github.com/Stolichnayer/SQLi-Hotel-Management-System?tab=readme-ov-file#%EF%B8%8F-steps-to-reproduce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2553 · Security Note
• https://twitter.com/CVEnew/status/2023365896358535326 · Twitter Post
• https://vuldb.com/?submit.750080 · Note
• https://t.me/CVEtracker/44816 · Telegram Post
• https://vuldb.com/?ctiid.346162 · Note
• https://twitter.com/NewsNerdie/status/2023661484283195750 · Twitter Post
• https://vuldb.com/?id.346162 · Note
• https://github.com/Stolichnayer/SQLi-Hotel-Management-System · Note