An unauthenticated SQL injection vulnerability in the Hotel and Lodge Management System 1.0 allows remote attackers to compromise database integrity, posing a significant risk to system data.

The application is vulnerable to SQL injection via the ID parameter in the edit_customer.php file. The vulnerability is exploitable by unauthenticated remote attackers.

The ability to execute arbitrary SQL commands allows an attacker to bypass authentication, access sensitive customer records, or modify the database content. Given the CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the hotel management platform, potentially leading to significant data breaches and operational disruption.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the edit_customer.php file through network-level controls or by disabling the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the edit_customer.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting parameter-based inputs.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability data.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing SourceCodester Hotel and Lodge Management System 1.0 must treat this as a high-priority issue. Implement the recommended compensating controls immediately and monitor vendor channels for the release of an official security update.