A vulnerability was detected in itsourcecode Online Hotel Management System 1

CVE-2026-13552 is an injection-class flaw (CWE-74) in *itsourcecode Online Hotel Management System 1.0*, one of dozens of free PHP/MySQL teaching projects published by itsourcecode.com for students learning web development. Vendor scored it HIGH (CVSS 7.3 — AV:N/AC:L/PR:N/UI:N) because the input goes straight into a database or interpreter without sanitization, and the project's admin login is reachable over the network with no auth. The 1.0 release is the *only* release; there is no patched version, no maintenance branch, and no security response process — itsourcecode is a code-share site, not a vendor.

The CVSS vector is technically accurate for the code as written, but enterprise relevance is essentially zero. This package is downloaded as a .zip learning artifact, dropped into XAMPP on a student's laptop, demonstrated for a class, and deleted. There is no installed-base data on Shodan, Censys, or BuiltWith showing this codebase in commercial hotel operations. Real PMS deployments run Oracle OPERA, Mews, Cloudbeds, RoomRaccoon, or protel — not a CWE-74-laden tutorial. Treating this CVE as HIGH for any production environment misallocates patching cycles.

Why this verdict

• Installed base is effectively zero in enterprise: Real PMS deployments run Oracle OPERA, Mews, Cloudbeds, protel, RoomRaccoon — none of them itsourcecode tutorial PHP. Shodan/Censys carry no commercial signal.
• No vendor, no patch, no SLA upstream: itsourcecode is a code-sharing portal. There is no maintenance branch to track and no CPE to match against your SBOM — your scanner will not flag this on any host you actually own.
• Friction audit: to be hit, you must (a) have downloaded this exact tutorial, (b) deployed it to a network-reachable host, (c) skipped every default control (WAF, EDR, NGFW egress) — the population satisfying all three rounds to zero.
• Role multiplier: even in the worst plausible deployment role this codebase ends up in (a student XAMPP VM or a $3/mo shared-hosting demo), the blast radius is local to that host. It is not a hypervisor, IdP, DC, CA, backup server, kernel-mode agent, or edge appliance. There is no high-value role to floor the verdict on.
• Pattern recognition: this is the latest in a long string of low-effort itsourcecode CVEs (CVE-2026-5551, -3730, -3152, and dozens more). They consume scanner cycles and CVE-feed noise; they do not change enterprise risk.

Why not higher?

Higher requires either a measurable enterprise installed base or a high-value-role multiplier. This codebase has neither — there is no fleet of itsourcecode OHMS running production hotels, and the affected component is not a hypervisor, IdP, PAM, backup, edge appliance, or kernel-mode agent. CVSS vector severity does not survive contact with deployment reality.

Why not lower?

We stop at IGNORE rather than carve a new floor below LOW because IGNORE *is* the lowest action bucket. If you genuinely run this codebase (you almost certainly do not), the bug is real and exploitable, so it is not a documentation-only artifact for that one defender — but for everyone else, ignore + document is correct.

1. Inventory check, then close the ticket — Grep your CMDB / SBOM / asset inventory for itsourcecode, Online Hotel Management System, and the project's signature filenames (mod_room, mod_guest, mod_amenities). Zero hits = close as not-applicable. No mitigation SLA applies — document the rationale and move on.
2. Suppress this CVE family in your scanner — If Tenable / Qualys / Rapid7 ever ships a plugin for itsourcecode projects, add a suppression rule scoped to non-enterprise CPEs so this class does not consume triage cycles every Tuesday. Do this within the next maintenance window.
3. If (somehow) you do run it: take it offline — There is no patch. Decommission the instance, migrate the data to a real PMS, and rebuild the host. No 30/90/180-day SLA — the only correct action is removal.

Run this on any inventory/asset host or auditor workstation with read access to your web-root snapshots and SBOM exports. Example: ./check-ohms.sh /mnt/asset-snapshots /var/sbom/exports. No elevated privileges required.

#!/usr/bin/env bash
# noisgate: detect presence of itsourcecode Online Hotel Management System 1.0
# Exits: 0 PATCHED (not present), 1 VULNERABLE (present), 2 UNKNOWN (no inputs)
set -u

SEARCH_ROOTS=("${1:-/srv/www}" "${2:-/var/www}")
SIGNATURES=(
  "itsourcecode"
  "Online Hotel Management System"
  "mod_amenities"
  "mod_room"
  "mod_guest"
  "hotel/admin/login.php"
)

hits=0
any_root=0
for root in "${SEARCH_ROOTS[@]}"; do
  if [[ -d "$root" ]]; then
    any_root=1
    for sig in "${SIGNATURES[@]}"; do
      count=$(grep -rlI --include='*.php' --include='*.html' -F "$sig" "$root" 2>/dev/null | wc -l)
      if [[ "$count" -gt 0 ]]; then
        echo "[hit] signature='$sig' files=$count root=$root"
        hits=$((hits+count))
      fi
    done
  fi
done

if [[ "$any_root" -eq 0 ]]; then
  echo "UNKNOWN: no search roots present, supply paths as args"
  exit 2
fi

if [[ "$hits" -gt 0 ]]; then
  echo "VULNERABLE: itsourcecode OHMS artifacts found ($hits matches) — decommission, no patch exists"
  exit 1
fi

echo "PATCHED: itsourcecode OHMS not present in scanned roots"
exit 0

Sources

1. CISA Vulnerability Summary — Week of June 15, 2026
2. OpenCVE — Hotel Management System CVEs
3. CVE-2026-5551 — sibling itsourcecode Free Hotel Reservation System SQLi
4. CVE-2026-3730 — itsourcecode Free Hotel Reservation System SQLi (DailyCVE)
5. CVE-2026-3152 — itsourcecode College Management System SQLi (OffSeq)
6. GitHub Advisory Database — unreviewed advisories
7. VulDB — CVE list
8. CWE-74 — Improper Neutralization of Special Elements (Injection)