An unauthenticated SQL injection vulnerability in Inout EasyRooms Ultimate Edition v1.0 poses a critical risk of unauthorized database access and potential data exfiltration.

The application is vulnerable to SQL injection (CWE-89) due to improper neutralization of special elements in the numguest, guests, location, and property1 POST parameters on the search/searchdetailed and search/rentals endpoints. Unauthenticated attackers can inject malicious SQL payloads to interact directly with the backend database.

Successful exploitation allows attackers to bypass authentication mechanisms, extract sensitive customer or administrative data, and modify database contents. Given the CVSS score of 8.2, this vulnerability represents a high-severity risk that could lead to significant data breaches, loss of confidentiality, and potential service disruption for the affected booking platform.

Immediate Action: As no official patch is currently available, organizations should restrict public access to the vulnerable search endpoints or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for POST requests to the /search/searchdetailed or /search/rentals endpoints containing suspicious SQL keywords, such as UNION, SELECT, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting these specific parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46630.

The presence of a public exploit for this SQL injection vulnerability necessitates urgent attention. Administrators must implement immediate compensating controls, such as WAF filtering, to protect the database layer. Given the lack of a vendor-supplied patch, organizations should consider the product's security posture and limit external exposure of the application until remediation is confirmed.