An unauthenticated SQL injection vulnerability in SourceCodester Hotel and Lodge Management System 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability is a SQL injection flaw located in the /edit_curr.php file. An unauthenticated remote attacker can inject malicious SQL commands via the currsymbol parameter to manipulate database queries.

The exploitation of this vulnerability could lead to the unauthorized disclosure, modification, or destruction of sensitive data stored within the hotel management database. With a CVSS score of 7.3, this flaw is categorized as high severity, indicating that it could result in substantial operational disruption or the compromise of customer and business information.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected web application or disable the vulnerable /edit_curr.php functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor database logs for unusual query patterns, such as unexpected syntax errors or suspicious characters associated with SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the currsymbol parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the provided GitHub issue reference.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate risk to the confidentiality and integrity of the application. Organizations must treat this as a high priority and implement compensating controls immediately while awaiting a formal vendor patch.