CVE-2009-4617: Multiple SQL injection vulnerabilities in Tourism Script Accommodation Hotel Booking Portal Script allow re...

Security readout for executives and security teams

This CVE describes SQL injection in an old hotel booking portal script. A remote attacker could send malicious input through the hotel_id field on several public pages and potentially manipulate the site database. The source bundle does not identify affected versions, a vendor patch, or active exploitation. Exposure is likely limited to organizations still running this specific Tourism Script accommodation booking portal, especially with the named PHP pages internet-accessible. The bundle provides no affected version range or CPE data, so asset confirmation requires application fingerprinting and code review. Treat as high priority if the script is deployed on a public booking site. SQL injection can threaten booking data, customer records, and site integrity. If the product is not in use, no action is needed beyond documenting non-exposure. Mitigation focus: Check vendor or maintainer guidance for any fixed release.; Retire or replace unsupported deployments of this script.; Restrict public access to affected pages until assessed..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.