A flaw has been found in itsourcecode Online Hotel Management System 1

CVE-2026-13553 is an improper access control (CWE-284) flaw in itsourcecode Online Hotel Management System v1.0 — a free, downloadable PHP/MySQL learning project distributed from itsourcecode.com, the same source factory that produces dozens of near-identical 'CVE-of-the-week' submissions every quarter (Free Hotel Reservation, Hospital Management, College Management, Baptism Information Management, etc.). The affected version is the only version: there is no v2.0, no enterprise edition, no maintained branch. Reports against this codebase typically arrive via Chinese-language researcher disclosures with a single-line PoC and no upstream maintainer response.

Vendor severity of HIGH / 7.3 is a CVSS calculator artifact, not a real-world judgment. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L is mechanically defensible — yes, it's network-reachable; yes, no auth is required — but the 'enterprise' installed base of this software is effectively zero. It's used by CS students, freelance devs building portfolios, and the occasional small guesthouse that found it on a tutorial blog. For a 10,000-host fleet, this CVE belongs in the *prove we don't run it* pile, not the patch queue.

Why this verdict

• Installed-base floor breached: itsourcecode demo apps consistently show single-digit-to-low-hundreds public exposure across Shodan/FOFA — well below the 1% threshold for the HIGH floor, and there is no high-value deployment role for a hotel-booking demo (no IdP, hypervisor, CA, backup, or edge role exists for this software class).
• Role multiplier: none. Even the worst plausible deployment is a small hotel's booking site. The chain ends at 'attacker reads test bookings.' No domain, tenant, fleet, or supply-chain pivot exists.
• No upstream maintainer, no patch, no vendor SLA — meaning the only viable remediation is removal or replacement, which reinforces this as a *don't run it* call rather than a *patch it* call.
• EPSS expected <0.1% and no KEV — consistent with the entire itsourcecode CVE corpus, which functions as researcher CV padding, not adversary tradecraft.

Why not higher?

MEDIUM would imply a non-trivial enterprise installed base or a plausible chain to credential/identity impact. Neither exists: this is a tutorial-grade PHP app with no realistic blast radius beyond its own MySQL table. Vendor HIGH (7.3) is mechanically derived from the CVSS vector and ignores the population-of-targets denominator entirely.

Why not lower?

Not IGNORE because the flaw is genuinely a real access-control bug, network-reachable, unauthenticated, with a public PoC pattern — if you *do* happen to run this code on the internet, you will get hit by opportunistic scanners. LOW correctly captures 'real bug, real PoC, near-zero enterprise relevance, document and move on.'

1. Inventory for the codebase, not the CVE — Grep your web-asset inventory and CMDB for filenames and HTML fingerprints unique to itsourcecode Hotel Management System (look for itsourcecode strings, distinctive admin paths, the project's copyright footer). MEDIUM verdict has no mitigation SLA, but a one-time inventory sweep within the next quarter is appropriate hygiene.
2. Block direct access to /admin/ endpoints at the reverse proxy — Any instance you find should sit behind an authenticating reverse proxy (nginx auth_basic, an SSO proxy like oauth2-proxy, or a WAF rule denying unauthenticated POSTs to admin paths). This neutralizes the entire CWE-284 class for this and every sibling itsourcecode CVE.
3. Decommission or replace any found instances — There is no upstream patch and never will be. The correct disposition is removal. Migrate any small-property booking workflows to a maintained PMS or a static-page + form-handler architecture within the noisgate remediation SLA window.
4. Add itsourcecode fingerprints to your external-attack-surface scanner — Tag the entire itsourcecode family (Hotel, Hospital, College, Reservation, Baptism, etc.) as a single 'unmaintained PHP demo' class in your EASM tool so future siblings are caught automatically rather than re-triaged one CVE at a time.

Run from an auditor workstation or asset-inventory host with read access to your web-asset inventory and reachable HTTP probes to candidate hosts. Invoke as ./check-itsourcecode-hms.sh targets.txt where targets.txt is a newline-separated list of URLs. No elevated privileges needed — only outbound HTTP.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-13553
# Detects itsourcecode Online Hotel Management System v1.0 presence.
# Exit codes: 0 = PATCHED/not present, 1 = VULNERABLE, 2 = UNKNOWN
set -u

if [[ $# -lt 1 ]]; then
  echo "usage: $0 <targets-file>" >&2
  exit 2
fi

TARGETS="$1"
FOUND=0
UNKNOWN=0

# Fingerprints unique to itsourcecode Hotel Management System v1.0
FP1='itsourcecode'
FP2='Online Hotel Management System'
FP3='hotel/admin'

while IFS= read -r url; do
  [[ -z "$url" ]] && continue
  body=$(curl -fsSL --max-time 8 -A 'noisgate/1.0' "$url" 2>/dev/null || true)
  if [[ -z "$body" ]]; then
    echo "UNKNOWN  $url  (no response)"
    UNKNOWN=1
    continue
  fi
  if grep -qiE "$FP1|$FP2|$FP3" <<<"$body"; then
    echo "VULNERABLE  $url  (itsourcecode HMS fingerprint matched)"
    FOUND=1
  else
    echo "PATCHED  $url  (no fingerprint)"
  fi
done < "$TARGETS"

if [[ $FOUND -eq 1 ]]; then exit 1; fi
if [[ $UNKNOWN -eq 1 ]]; then exit 2; fi
exit 0

Sources

1. CISA Weekly Vulnerability Bulletin (sibling itsourcecode CVEs)
2. OpenCVE — Hotel Management System vendor index
3. GitHub disclosure pattern — jasonwong666/cve issue #1 (itsourcecode Free Hotel Reservation SQLi)
4. DailyCVE — itsourcecode Free Hotel Reservation System SQLi (CVE-2026-3730)
5. OffSeq Threat Radar — itsourcecode Hospital Management (CVE-2026-13520)
6. RedPacket Security — itsourcecode Free Hotel Reservation (CVE-2026-5551)
7. CVEfeed — itsourcecode College Management System (CVE-2026-3152)
8. GitHub Advisory Database (unreviewed advisories index)