CVE-2020-21012
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection. Remote attackers can execute arbitrary SQL commands via the email parameter on the edit pages for Customer, Room, Currency, Room Booking Details, or Tax Details.
Risk Assessment
Potential unauthorized database access, data modification or leakage, and consequent system compromise.
Recommendation
Update the system to a patched version or apply input validation and parameterized queries. Restrict access to the administrative interface.
Other vulnerabilities in Hotel and Lodge Management System
See all- CVE-2025-11474Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /edit_booking.php. Manipulating the Name argument allows remote attack. The exploit has been publicly disclosed and may be used.
- CVE-2025-11398Medium
A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the file /profile.php of the component Profile Page. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
Original NVD description (English source)
Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS