A free PHP demo project from a tutorial site gets a HIGH CVE because the CVSS calculator doesn't ask who actually runs this code
CVE-2026-13553 is an improper access control (CWE-284) flaw in itsourcecode Online Hotel Management System v1.0 — a free, downloadable PHP/MySQL learning project distributed from itsourcecode.com, the same source factory that produces dozens of near-identical 'CVE-of-the-week' submissions every quarter (Free Hotel Reservation, Hospital Management, College Management, Baptism Information Management, etc.). The affected version is the only version: there is no v2.0, no enterprise edition, no maintained branch. Reports against this codebase typically arrive via Chinese-language researcher disclosures with a single-line PoC and no upstream maintainer response.
Vendor severity of HIGH / 7.3 is a CVSS calculator artifact, not a real-world judgment. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L is mechanically defensible — yes, it's network-reachable; yes, no auth is required — but the 'enterprise' installed base of this software is effectively zero. It's used by CS students, freelance devs building portfolios, and the occasional small guesthouse that found it on a tutorial blog. For a 10,000-host fleet, this CVE belongs in the *prove we don't run it* pile, not the patch queue.
3 steps from start to impact.
Locate an exposed instance
/admin/, /hotel/, copyright footer strings). Shodan/FOFA queries for the template strings return a few hundred globally — mostly home labs, university assignments, and abandoned demo deployments.- Internet-reachable instance of the exact v1.0 codebase
- Default URL layout left intact
- Almost zero enterprise deployment
- Most instances are localhost / XAMPP on student laptops, not public-facing
Trigger the access-control flaw
admin/-prefixed PHP file that doesn't check $_SESSION. The vendor CVSS suggests partial CIA impact (C:L/I:L/A:L), so it's a limited data read or limited state change, not full RCE.- Knowledge of the vulnerable endpoint path (trivially derived from public source)
- No reverse-proxy ACL in front
- The code is open-source — exploitation is trivial but so is auditing
- Real impact bounded to whatever hotel records the toy app holds
/admin/* direct access will catch most variants; no vendor-specific signatureRead or modify booking data
- Successful unauthenticated reach to admin endpoint
- Blast radius is the one MySQL instance backing this app
- Data is hobbyist-grade — fake bookings, test users
itsourcecode strings, distinctive admin paths, the project's copyright footer). MEDIUM verdict has no mitigation SLA, but a one-time inventory sweep within the next quarter is appropriate hygiene./admin/ endpoints at the reverse proxy — Any instance you find should sit behind an authenticating reverse proxy (nginx auth_basic, an SSO proxy like oauth2-proxy, or a WAF rule denying unauthenticated POSTs to admin paths). This neutralizes the entire CWE-284 class for this and every sibling itsourcecode CVE.- Generic 'patch this week' workflow — there is no patch to apply; routing this through normal patch tooling wastes ticket cycles.
- Vendor CVSS-based prioritization — taking the 7.3 HIGH at face value pulls attention from genuinely high-impact CVEs released the same day.
- WAF signature updates from the WAF vendor — no commercial WAF ships itsourcecode-specific rules; you'll need a generic admin-path ACL written by hand.
The supporting signals.
| In-the-wild exploitation | None observed. No KEV listing, no GreyNoise tag, no campaign telemetry. itsourcecode CVE class is researcher-farm output, not adversary-prioritized. |
|---|---|
| Public PoC | Likely a single-line curl PoC in the original disclosure issue (pattern matches sibling CVEs like CVE-2026-5551, CVE-2026-3730, CVE-2026-3152 — all from the same disclosure mill). |
| EPSS | Expected <0.1% (<5th percentile) — consistent with the entire itsourcecode CVE corpus, which never accrues real exploitation telemetry. |
| KEV status | Not listed. CISA does not track this software class. |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L → 7.3 HIGH. Mechanically correct, contextually meaningless. |
| Affected versions | itsourcecode Online Hotel Management System 1.0 — the only released version. |
| Fixed versions | None. No maintained upstream, no patch commit, no security branch. Distro packaging: none. |
| Exposure data | Shodan/FOFA queries for the app's HTML fingerprints typically return low-hundreds globally — predominantly student/demo deployments, not regulated infrastructure. |
| Disclosed | 2026-06-29 (today). Pattern matches the CISA weekly bulletin batch dumps of small-PHP-app CVEs. |
| Reporter | Consistent with the jasonwong666 / Chinese researcher cohort that files dozens of similar itsourcecode disclosures. |
Sources.
- CISA Weekly Vulnerability Bulletin (sibling itsourcecode CVEs)
- OpenCVE — Hotel Management System vendor index
- GitHub disclosure pattern — jasonwong666/cve issue #1 (itsourcecode Free Hotel Reservation SQLi)
- DailyCVE — itsourcecode Free Hotel Reservation System SQLi (CVE-2026-3730)
- OffSeq Threat Radar — itsourcecode Hospital Management (CVE-2026-13520)
- RedPacket Security — itsourcecode Free Hotel Reservation (CVE-2026-5551)
- CVEfeed — itsourcecode College Management System (CVE-2026-3152)
- GitHub Advisory Database (unreviewed advisories index)
Why this verdict
- Installed-base floor breached: itsourcecode demo apps consistently show single-digit-to-low-hundreds public exposure across Shodan/FOFA — well below the 1% threshold for the HIGH floor, and there is no high-value deployment role for a hotel-booking demo (no IdP, hypervisor, CA, backup, or edge role exists for this software class).
- Role multiplier: none. Even the worst plausible deployment is a small hotel's booking site. The chain ends at 'attacker reads test bookings.' No domain, tenant, fleet, or supply-chain pivot exists.
- No upstream maintainer, no patch, no vendor SLA — meaning the only viable remediation is removal or replacement, which reinforces this as a *don't run it* call rather than a *patch it* call.
- EPSS expected <0.1% and no KEV — consistent with the entire itsourcecode CVE corpus, which functions as researcher CV padding, not adversary tradecraft.
Why not higher?
MEDIUM would imply a non-trivial enterprise installed base or a plausible chain to credential/identity impact. Neither exists: this is a tutorial-grade PHP app with no realistic blast radius beyond its own MySQL table. Vendor HIGH (7.3) is mechanically derived from the CVSS vector and ignores the population-of-targets denominator entirely.
Why not lower?
Not IGNORE because the flaw is genuinely a real access-control bug, network-reachable, unauthenticated, with a public PoC pattern — if you *do* happen to run this code on the internet, you will get hit by opportunistic scanners. LOW correctly captures 'real bug, real PoC, near-zero enterprise relevance, document and move on.'
Crowdsourced verification payload.
Run from an auditor workstation or asset-inventory host with read access to your web-asset inventory and reachable HTTP probes to candidate hosts. Invoke as ./check-itsourcecode-hms.sh targets.txt where targets.txt is a newline-separated list of URLs. No elevated privileges needed — only outbound HTTP.
#!/usr/bin/env bash
# noisgate verifier — CVE-2026-13553
# Detects itsourcecode Online Hotel Management System v1.0 presence.
# Exit codes: 0 = PATCHED/not present, 1 = VULNERABLE, 2 = UNKNOWN
set -u
if [[ $# -lt 1 ]]; then
echo "usage: $0 <targets-file>" >&2
exit 2
fi
TARGETS="$1"
FOUND=0
UNKNOWN=0
# Fingerprints unique to itsourcecode Hotel Management System v1.0
FP1='itsourcecode'
FP2='Online Hotel Management System'
FP3='hotel/admin'
while IFS= read -r url; do
[[ -z "$url" ]] && continue
body=$(curl -fsSL --max-time 8 -A 'noisgate/1.0' "$url" 2>/dev/null || true)
if [[ -z "$body" ]]; then
echo "UNKNOWN $url (no response)"
UNKNOWN=1
continue
fi
if grep -qiE "$FP1|$FP2|$FP3" <<<"$body"; then
echo "VULNERABLE $url (itsourcecode HMS fingerprint matched)"
FOUND=1
else
echo "PATCHED $url (no fingerprint)"
fi
done < "$TARGETS"
if [[ $FOUND -eq 1 ]]; then exit 1; fi
if [[ $UNKNOWN -eq 1 ]]; then exit 2; fi
exit 0