A SQL injection issue exists in the Hotel-Management-System. The issue is located in an unknown function within the `/admin/invoiceprint.php` file. Manipulating the `ID` argument can trigger the injection. This can be initiated remotely. The exploit is publicly available.