Simple Online Hotel Reservation System vulnerabilities

A SQL injection flaw was discovered in Simple Online Hotel Reservation System 2.0 in /admin/add_account.php via manipulation of the Name argument. The attack can be performed remotely and a public exploit is available.

An unrestricted file upload vulnerability was identified in Simple Online Hotel Reservation System 2.0 in /admin/edit_room.php (Photo Handler component). The attack can be carried out remotely and a public exploit is available.

A Cross Site Scripting (XSS) vulnerability was found in the Add Room function of Simple Online Hotel Reservation System 1.0. Malicious JavaScript entered in the Description field can leak administrator cookies when viewing room details.