An unauthenticated SQL injection vulnerability in the uHotelBooking System allows remote attackers to manipulate database queries and potentially extract sensitive information.

This is an improper neutralization of special elements used in an SQL command (CWE-89). Unauthenticated attackers can inject malicious SQL code through the system_page parameter in the index.php script to execute time-based blind SQL injection attacks.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the unauthorized extraction of sensitive user data, reservation details, or administrative credentials stored within the backend database. With a CVSS score of 8.2, this vulnerability is categorized as High severity and requires immediate remediation to prevent potential data breaches.

Immediate Action: There is no official vendor patch available for this legacy software. Organizations should immediately restrict access to the application or migrate to a secure, supported booking platform.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax, such as "XOR", "sleep", or "sysdate", directed at the index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns in URL parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented on Exploit-DB (EDB-ID: 46587).

Given the lack of vendor support and the availability of a public proof-of-concept, the risk of exploitation is significant. Organizations still utilizing the uHotelBooking System must prioritize migrating to a modern, supported solution, as patching the existing codebase is not a viable long-term strategy for securing this platform against automated SQL injection attacks.