A critical SQL injection vulnerability in SourceCodester Online Hotel Reservation System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

This is a SQL injection vulnerability (CWE-89) located in the deleteroominventory.php file. The application fails to properly sanitize the id parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands directly into the database query.

Successful exploitation of this vulnerability allows unauthorized actors to gain complete control over the application database. This can lead to the exfiltration of sensitive customer data, unauthorized modification or deletion of reservation records, and potential service interruption, which severely impacts business operations and data integrity. While the CVSS score of 7.3 reflects a high severity, the ability for an unauthenticated attacker to manipulate the backend database poses a significant risk to organizational security.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the deleteroominventory.php endpoint or disable the affected module entirely until a secure version is released.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests targeting deleteroominventory.php, specifically searching for SQL syntax characters or time-based blind injection patterns like SLEEP().

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the id parameter. Ensure the database user account associated with the application is configured with the least privilege necessary to limit the scope of a potential breach.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the research write-up by the vulnerability reporter.

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability presents a credible threat to any deployment of the Online Hotel Reservation System. Organizations must prioritize the implementation of compensating controls, such as WAF filtering, and isolate the vulnerable system from public-facing networks until a formal security update is provided by the vendor.