An unauthenticated SQL injection vulnerability in SourceCodester Hotel Reservation System 1.0 poses a critical risk of full database compromise and unauthorized data manipulation.

The application fails to sanitize the id parameter in the deleteuser.php script before incorporating it into SQL queries. This allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized database access, data modification, or system-wide disruption.

Successful exploitation of this flaw grants an attacker the ability to bypass authentication and directly interact with the backend database. This can lead to the exfiltration of sensitive reservation data, unauthorized deletion of user records, or total loss of data integrity. Given the 7.3 CVSS score, this represents a significant threat to business continuity and regulatory compliance.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the affected file (deleteuser.php) or place the application behind a secure authentication gateway.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests targeting the deleteuser.php endpoint, specifically looking for SQL injection payloads containing syntax such as SLEEP, SELECT, or UNION.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in URL parameters to mitigate the risk of exploitation while a permanent code-level fix is developed.

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up referenced by the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation via unauthenticated remote access, this vulnerability must be treated with high urgency. Organizations using this software should prioritize isolating the affected component and implementing robust input validation or access controls to prevent unauthorized database interactions until a formal vendor update is released.