Cyber Posture

CVE-2026-3806

MediumPublic PoC

Published: 09 March 2026

Published
09 March 2026
Modified
09 March 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0003 9.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3806 is a medium-severity Injection (CWE-74) vulnerability in Oretnom23 Resort Reservation System. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-74

Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

addresses: CWE-74

Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in a network-accessible web application (room_rates.php) directly enables remote exploitation of a public-facing app per T1190; low-priv authenticated access and public PoC confirm the mapping with no other techniques directly indicated.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php. This manipulation of the argument q causes sql injection. The attack can be initiated remotely. The exploit has been…

more

made available to the public and could be used for attacks.

Deeper analysisAI

CVE-2026-3806 is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester/janobe Resort Reservation System 1.0. The flaw affects the processing of the /room_rates.php file, where manipulation of the 'q' argument triggers the injection.

The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), allowing remote exploitation over the network with low attack complexity. It requires low privileges (PR:L) and no user interaction, enabling attackers with such access to achieve low-level impacts on confidentiality, integrity, and availability.

Advisories and details are documented in references including a GitHub proof-of-concept at https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Resort-Reservation-System---SQLi2.md and VulDB entries at https://vuldb.com/?ctiid.349772, https://vuldb.com/?id.349772, and https://vuldb.com/?submit.768999. The exploit has been publicly released and could be used for attacks; security practitioners should review these for mitigation steps.

Notable context includes the public availability of the exploit, published on 2026-03-09, increasing the risk of real-world exploitation against unpatched instances.

Details

CWE(s)

Affected Products

oretnom23
resort reservation system
1.0

CVEs Like This One

CVE-2026-3771Same product: Oretnom23 Resort Reservation System
CVE-2026-3800Same product: Oretnom23 Resort Reservation System
CVE-2026-2848Same vendor: Oretnom23
CVE-2026-3746Same vendor: Oretnom23
CVE-2025-0173Same vendor: Oretnom23
CVE-2026-30531Same vendor: Oretnom23
CVE-2026-30533Same vendor: Oretnom23
CVE-2026-30529Same vendor: Oretnom23
CVE-2026-3752Same vendor: Oretnom23
CVE-2025-2387Same vendor: Oretnom23

References