CVE-2026-13553: Unrestricted File Upload in itsourcecode Hotel Management System 1.0

Technical summary

CVE-2026-13553 is an unrestricted file upload vulnerability affecting itsourcecode Online Hotel Management System 1.0. The flaw resides in /admin/mod_amenities/controller.php?action=add, where insufficient validation of the image parameter permits arbitrary file uploads. The vulnerability combines improper access control (CWE-284) with unrestricted file uploads (CWE-434). The CVSS v3.1 score of 7.3 (HIGH) reflects network-based exploitation without authentication, resulting in confidentiality, integrity, and availability impact. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, though public exploit code exists.

Business impact

Successful exploitation enables attackers to upload and execute malicious files on hotel management servers, potentially leading to data theft of guest and administrative records, lateral movement within hotel networks, or deployment of malware. Hotels using this system for operations management face business continuity risk if attackers corrupt or encrypt stored files. Guest privacy violations from unauthorized access to booking and personal information could trigger regulatory consequences and reputational damage.

Affected systems

itsourcecode Online Hotel Management System version 1.0 is directly affected. Organizations running this specific version, particularly small to mid-sized hotels or hospitality groups that adopted this open-source or low-cost management platform, should assume they are at risk. No patch version information is available from vendor advisories at this time; verify directly with itsourcecode for remediation availability.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, can be triggered over the network, and involves no user interaction—meeting the criteria for a trivial attack path. Published exploit code is available, lowering the barrier to weaponization. The admin panel endpoint is typically accessible to authenticated users, but the lack of authentication controls mentioned in the description suggests the /admin path itself may not require valid credentials, further increasing risk.

Remediation

Immediately identify all systems running itsourcecode Online Hotel Management System 1.0 and isolate them from untrusted networks if patched versions are unavailable. Check the vendor's GitHub repository or official channels for security updates or patches addressing CWE-434 (unrestricted file upload) and CWE-284 (improper access control). If no patch exists, implement server-level controls: restrict upload directories to non-executable locations, validate file extensions and MIME types server-side, disable script execution in upload directories via .htaccess or web server configuration, and enforce strict file permission policies.

Patch guidance

Contact itsourcecode directly or monitor their official repository for a patched release beyond version 1.0. Verify any update against the vendor advisory to confirm the file upload validation controls have been hardened. Until a patch is confirmed, apply compensating controls such as disabling the amenities module if not essential, restricting admin access to trusted IP ranges, and deploying web application firewalls to inspect and block suspicious upload requests to the vulnerable endpoint.

Detection guidance

Monitor access logs for POST or GET requests to /admin/mod_amenities/controller.php with action=add parameters, especially those containing unusual file extensions or suspicious MIME types in the image parameter. Look for file uploads to unexpected directories on the system. Review the upload directory for files with non-image extensions (e.g., .php, .jsp, .exe, .sh) created around the time of suspected exploitation. Deploy file integrity monitoring on the web root and upload directories to detect unauthorized file creation or modification.

Why prioritize this

Despite not being on CISA's KEV list, this vulnerability warrants immediate remediation priority due to its high CVSS score (7.3), unauthenticated remote exploitability, published exploit code, and direct impact on data confidentiality and system integrity. Hotels operate guest-facing systems containing sensitive personal and payment data; compromise could trigger compliance violations and business disruption. The attack is trivial to execute and widely applicable to any deployed instance of version 1.0.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The impact vector covers confidentiality, integrity, and availability loss (C:L/I:L/A:L) without scope change. This score appropriately captures the severity of unauthenticated arbitrary file upload as a critical stepping stone to remote code execution or data exfiltration, though organizations should assume actual risk exceeds the scored impact if file execution is possible post-upload.

Frequently asked questions