The SourceCodester Online Hotel Reservation System contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) flaw located in the deleteslide.php file. An unauthenticated attacker can execute arbitrary SQL commands by manipulating the ID parameter, as the application fails to properly sanitize user input.

The ability for an unauthenticated user to inject SQL commands poses a significant risk to the confidentiality and integrity of the hotel reservation database. Successful exploitation could lead to unauthorized data exfiltration, modification of reservation records, or potential administrative account compromise. Given the CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent operational disruption and data loss.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the vulnerable deleteslide.php endpoint via firewall rules or by disabling the affected functionality.

Proactive Monitoring: Review database query logs for suspicious patterns or anomalous syntax consistent with SQL injection attempts. Monitor web server access logs for repeated requests to the deleteslide.php script from unauthorized sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced security write-up.

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability elevates the risk significantly. Organizations utilizing SourceCodester Online Hotel Reservation System version 1.0 must treat this as a priority, implementing strict access controls or disabling the vulnerable module until a formal security update is provided by the vendor.