A critical SQL injection vulnerability in Fishing Reservation System 7.5 allows remote, unauthenticated attackers to compromise the underlying database and web application.

This vulnerability is a classic SQL injection (CWE-89) affecting multiple parameters, including uid, pid, type, m, y, and code. The application fails to properly neutralize user input, allowing attackers with guest access or low privileges to execute malicious SQL statements.

Successful exploitation grants an attacker the ability to interact directly with the backend database, potentially leading to unauthorized data extraction, modification, or complete system takeover. Given the CVSS score of 7.1, this vulnerability poses a significant risk to the confidentiality and integrity of reservation data and customer information, which could lead to severe reputational damage and regulatory non-compliance.

Immediate Action: As there is no official patch available, administrators should restrict public access to the affected files (admin.php, cart.php, and calendar.php) or disable the application until a fix is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax, such as "union select" or "--" sequences, targeting the identified parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious input patterns targeting the vulnerable parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Vulnerability Laboratory research write-up and ExploitDB entry 48417.

Given the availability of public proof-of-concept exploit code, the risk of exploitation is high. Organizations currently running Fishing Reservation System 7.5 must prioritize the implementation of compensating controls, such as WAF rules or network-level access restrictions, to protect the application while awaiting a vendor-supplied patch.