itsourcecode Online Hotel Management System 1.0 — CWE-74 Injection

CVE-2026-13552 is an injection-class flaw (CWE-74) in *itsourcecode Online Hotel Management System 1.0*, one of dozens of free PHP/MySQL teaching projects published by itsourcecode.com for students learning web development. Vendor scored it HIGH (CVSS 7.3 — AV:N/AC:L/PR:N/UI:N) because the input goes straight into a database or interpreter without sanitization, and the project's admin login is reachable over the network with no auth. The 1.0 release is the *only* release; there is no patched version, no maintenance branch, and no security response process — itsourcecode is a code-share site, not a vendor.

The CVSS vector is technically accurate for the code as written, but enterprise relevance is essentially zero. This package is downloaded as a .zip learning artifact, dropped into XAMPP on a student's laptop, demonstrated for a class, and deleted. There is no installed-base data on Shodan, Censys, or BuiltWith showing this codebase in commercial hotel operations. Real PMS deployments run Oracle OPERA, Mews, Cloudbeds, RoomRaccoon, or protel — not a CWE-74-laden tutorial. Treating this CVE as HIGH for any production environment misallocates patching cycles.

Sources.

1. CISA Vulnerability Summary — Week of June 15, 2026
2. OpenCVE — Hotel Management System CVEs
3. CVE-2026-5551 — sibling itsourcecode Free Hotel Reservation System SQLi
4. CVE-2026-3730 — itsourcecode Free Hotel Reservation System SQLi (DailyCVE)
5. CVE-2026-3152 — itsourcecode College Management System SQLi (OffSeq)
6. GitHub Advisory Database — unreviewed advisories
7. VulDB — CVE list
8. CWE-74 — Improper Neutralization of Special Elements (Injection)

Run this on any inventory/asset host or auditor workstation with read access to your web-root snapshots and SBOM exports. Example: ./check-ohms.sh /mnt/asset-snapshots /var/sbom/exports. No elevated privileges required.

#!/usr/bin/env bash
# noisgate: detect presence of itsourcecode Online Hotel Management System 1.0
# Exits: 0 PATCHED (not present), 1 VULNERABLE (present), 2 UNKNOWN (no inputs)
set -u

SEARCH_ROOTS=("${1:-/srv/www}" "${2:-/var/www}")
SIGNATURES=(
  "itsourcecode"
  "Online Hotel Management System"
  "mod_amenities"
  "mod_room"
  "mod_guest"
  "hotel/admin/login.php"
)

hits=0
any_root=0
for root in "${SEARCH_ROOTS[@]}"; do
  if [[ -d "$root" ]]; then
    any_root=1
    for sig in "${SIGNATURES[@]}"; do
      count=$(grep -rlI --include='*.php' --include='*.html' -F "$sig" "$root" 2>/dev/null | wc -l)
      if [[ "$count" -gt 0 ]]; then
        echo "[hit] signature='$sig' files=$count root=$root"
        hits=$((hits+count))
      fi
    done
  fi
done

if [[ "$any_root" -eq 0 ]]; then
  echo "UNKNOWN: no search roots present, supply paths as args"
  exit 2
fi

if [[ "$hits" -gt 0 ]]; then
  echo "VULNERABLE: itsourcecode OHMS artifacts found ($hits matches) — decommission, no patch exists"
  exit 1
fi

echo "PATCHED: itsourcecode OHMS not present in scanned roots"
exit 0