The Reservation Online Hotel Reservation System 1.0 is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database operations.

This vulnerability is a SQL injection flaw (CWE-89) located in the /reservation/paypalpayout.php file. An unauthenticated attacker can exploit this by manipulating the confirm argument to execute arbitrary SQL commands.

Successful exploitation of this vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of reservation data. Failure to address this flaw may result in data breaches and operational disruption for the hotel management platform.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /reservation/paypalpayout.php endpoint at the network or web server level.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union selects or suspicious boolean-based patterns, originating from the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the confirm parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up at https://github.com/xingrenlvke/cve/issues/10.

Due to the remote and unauthenticated nature of this vulnerability, immediate mitigation is required. Organizations using this software should isolate the affected component from public access until a vendor-supplied security update is released and verified. Prioritize the implementation of WAF rules to filter malicious input to the vulnerable parameter.