An unauthenticated SQL injection vulnerability in Wecodex Hotel CMS 1.0 allows remote attackers to bypass administrative authentication and potentially compromise sensitive database information.

The application fails to properly sanitize user-supplied data in the username parameter during the administrative login process, which occurs via a POST request to index.php with action=processlogin. This flaw allows an unauthenticated attacker to inject malicious SQL commands to bypass authentication controls or extract unauthorized data from the backend database.

Successful exploitation of this vulnerability permits unauthorized access to the administrative interface of the hotel management system. This exposure poses a significant risk of data exfiltration, including customer personal information and reservation records, which could lead to severe reputational damage and regulatory non-compliance. Given the CVSS score of 8.2, this vulnerability is classified as High severity due to the ease of exploitation and the potential for full administrative account takeover.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the administrative login page to trusted IP addresses only or disable the affected module if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the index.php file, specifically looking for unusual character strings or SQL keywords in the username parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, such as UNION SELECT or time-based sleep commands, targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry 44729.

Given the availability of a public exploit and the lack of a vendor-supplied patch, this vulnerability presents a clear and present danger to affected environments. Organizations currently running Wecodex Hotel CMS 1.0 must treat this as a high-priority issue and implement the recommended network-level restrictions or WAF filtering immediately to prevent unauthorized administrative access.