Cyber Posture

CVE-2026-4237

HighUpdated

Published: 16 March 2026

Published
16 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0004 13.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4237 is a high-severity Injection (CWE-74) vulnerability in Itsourcecode (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the SQL injection flaw in /hotel/admin/mod_reports/index.php for CVE-2026-4237 through timely patching and flaw correction processes.

prevent

Requires validation of the 'Home' argument to block malicious SQL payloads targeting the vulnerable code in mod_reports/index.php.

detectrespond

Vulnerability scanning detects and prioritizes SQL injection issues like CVE-2026-4237 in deployed Free Hotel Reservation System instances for remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Unauthenticated remote SQL injection in a public-facing web application (PHP admin module) directly enables initial access via exploitation of an internet-facing service, matching T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/mod_reports/index.php. Executing a manipulation of the argument Home can lead to sql injection. The attack may be performed from remote.…

more

The exploit has been published and may be used.

Deeper analysisAI

CVE-2026-4237 is a SQL injection vulnerability (CWE-74, CWE-89) in itsourcecode Free Hotel Reservation System 1.0. The issue affects unknown code in the file /hotel/admin/mod_reports/index.php, where manipulation of the "Home" argument enables the injection. Published on 2026-03-16, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated as high severity.

Remote attackers require no privileges or user interaction to exploit this flaw over the network with low complexity. Successful exploitation can result in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via injected SQL payloads.

Advisories from VulDB (ctiid.351179, id.351179, submit.771243) document the vulnerability, and a related GitHub issue in silver-guide provides further details. The vendor site at itsourcecode.com may offer updates, though no specific patches are detailed in the available information.

An exploit has been publicly disclosed and may be actively used, heightening the risk for unpatched deployments of this system.

Details

CWE(s)

Affected Products

Itsourcecode
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2026-3150Shared CWE-74, CWE-89
CVE-2026-5577Shared CWE-74, CWE-89
CVE-2026-2132Shared CWE-74, CWE-89
CVE-2026-0579Shared CWE-74, CWE-89
CVE-2026-3790Shared CWE-74, CWE-89
CVE-2026-2090Shared CWE-74, CWE-89
CVE-2026-1159Shared CWE-74, CWE-89
CVE-2026-6562Shared CWE-74, CWE-89
CVE-2026-4780Shared CWE-74, CWE-89
CVE-2026-4850Shared CWE-74, CWE-89

References