An unauthenticated SQL injection vulnerability in SourceCodester Hotel and Lodge Management System 1.0 allows remote attackers to compromise the database.

This vulnerability is a SQL injection flaw (CWE-89) located in the login.php file. The application fails to properly sanitize the email argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability can lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high-risk security flaw that could result in significant data breaches or total compromise of the application backend, potentially leading to reputational damage and loss of administrative control.

Immediate Action: As no official patch is currently available, administrators should restrict access to the login portal using network-level controls or consider disabling the affected service until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous characters, such as single quotes or SQL keywords, targeting the login.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting login forms.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability poses a significant risk to any organization running the affected software. Security teams must prioritize isolating the affected system from public-facing network segments and monitor for unauthorized access attempts until a vendor-supplied patch is identified and applied.