A vulnerability was found in itsourcecode Online Hotel Management System 1

CVE-2026-13555 is yet another injection-class flaw (CWE-74) in itsourcecode Online Hotel Management System 1.0 — a free PHP/MySQL learning project distributed via SourceCodester and itsourcecode.com. These applications are written as student tutorials, ship with default credentials, no input validation, and have been the subject of *hundreds* of CVE filings from the same disclosure mill. The 1.0 build is the only release; there is no patched downstream version because the project is effectively abandoned.

The vendor (VulDB-assigned) score of HIGH 7.3 via AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L is technically defensible against the vector — yes, it is network-reachable with no privileges — but it ignores that this software has *no measurable enterprise deployment*. There is no Shodan fingerprint of any scale, no KEV listing, no EPSS signal, and no commercial hotel chain runs a CodeIgniter tutorial as their PMS. For a fleet of 10,000 hosts the realistic exposure count is zero unless an internal dev spun up a copy in a lab.

Why this verdict

• Baseline check: VulDB 7.3 reflects the vector mechanics, not deployment reality. itsourcecode CVEs are systematically over-scored relative to real risk.
• Friction — population: Fewer than a rounding-error of enterprises run this code in production. The vuln is unreachable simply because nothing to reach exists in the fleet.
• Friction — impact ceiling: All three CIA components are capped at Low. No RCE, no privilege escalation, no lateral movement primitives documented.
• Role multiplier: The deployment-role spectrum for itsourcecode OHMS is (a) student laptop, (b) bootcamp lab VM, (c) abandoned demo container. There is no high-value role — no hotel chain, hospitality SaaS, or PMS vendor ships this code. The role-multiplier floor therefore does not apply; verdict floor stays at LOW.
• KEV/EPSS pressure: None. No exploitation telemetry, no campaign attribution, no scanner hits of significance.

Why not higher?

MEDIUM would require either a meaningful exposure population or a credible path to higher impact. Neither exists: the product has no enterprise footprint and the impacts are all-Low. HIGH is what VulDB filed and is unjustifiable outside the abstract vector math.

Why not lower?

IGNORE would be appropriate if we could guarantee the code is nowhere in the fleet, but shadow IT and dev sandboxes mean a non-zero probability of one developer spinning up a copy. LOW is the right bucket for 'document it, sweep for it, otherwise ignore.'

1. Inventory sweep for the fingerprint — Run an internal scan for the /Online-Hotel-Management-System/ URL path and the itsourcecode footer string across your IP space and dev/QA segments. No mitigation SLA at LOW — do this as part of the next quarterly hygiene cycle, not as an emergency.
2. Block egress from any lab VMs that host learning-project PHP apps — Default-deny outbound on lab segments neutralizes the data-exfil tail of any injection class bug. Fold into existing network segmentation review (target: 365-day remediation window).
3. WAF rule confirmation for generic SQLi/command-injection classes — If you front any internal app with ModSecurity/CRS or a cloud WAF, ensure paranoia level ≥2 for legacy PHP stacks. Already in place at most shops; just verify.
4. Decommission shadow-IT instances on discovery — If a sweep finds an itsourcecode OHMS instance, treat it as unmanaged shadow IT — destroy the VM/container, do not patch (there is no patch).

Run this on an auditor workstation (or a scanner host) with network reach into the segments you care about. Invoke as ./check-ohms.sh 10.0.0.0/16 — needs only outbound HTTP to the target range; no privileges required. Requires nmap and curl.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-13555 itsourcecode OHMS 1.0 footprint sweep
# Exit: 0 = PATCHED (none found), 1 = VULNERABLE (instance found), 2 = UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <CIDR or host>" >&2
  exit 2
fi

command -v nmap >/dev/null 2>&1 || { echo "nmap required" >&2; exit 2; }
command -v curl >/dev/null 2>&1 || { echo "curl required" >&2; exit 2; }

TMP=$(mktemp)
trap 'rm -f "$TMP"' EXIT

# 1. Find live web services on 80/443/8080/8000
nmap -Pn -p 80,443,8080,8000 --open -oG - "$TARGET" 2>/dev/null \
  | awk '/Ports:/ {split($0,a,"Host: "); split(a[2],b," "); host=b[1]; for(i=1;i<=NF;i++) if($i ~ /\/open\//){split($i,p,"/"); print host":"p[1]}}' \
  | sort -u > "$TMP"

FOUND=0
while IFS= read -r endpoint; do
  for scheme in http https; do
    for path in "/" "/Online-Hotel-Management-System/" "/hotel/" "/ohms/"; do
      url="${scheme}://${endpoint}${path}"
      body=$(curl -ks --max-time 5 -A "noisgate/1.0" "$url" || true)
      if echo "$body" | grep -qiE 'itsourcecode|Online Hotel Management System|sourcecodester'; then
        echo "VULNERABLE: itsourcecode OHMS fingerprint at $url"
        FOUND=1
      fi
    done
  done
done < "$TMP"

if [[ $FOUND -eq 1 ]]; then
  echo "Result: VULNERABLE (instance(s) found — decommission, do not patch)"
  exit 1
fi

echo "Result: PATCHED (no itsourcecode OHMS instances detected in $TARGET)"
exit 0

Sources

1. NVD — CVE-2026-13555
2. MITRE CVE record
3. VulDB (typical CNA for itsourcecode disclosures)
4. itsourcecode project page
5. CWE-74 — Injection
6. CISA KEV catalog
7. FIRST EPSS
8. GreyNoise visualizer