A remote SQL injection vulnerability in the SourceCodester Wedding Reservation Management System allows unauthenticated attackers to potentially compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located within the global.php file. The flaw is triggered by the manipulation of the User argument and requires no authentication to exploit.

The vulnerability carries a CVSS score of 7.3, reflecting its high potential for unauthorized database interaction. Successful exploitation allows for remote attackers to manipulate backend queries, which can lead to the unauthorized disclosure or modification of sensitive reservation data, potentially resulting in significant reputational damage and loss of customer trust.

Immediate Action: As there is no official patch available, administrators should immediately restrict access to the affected installation or take the application offline until a secure version is released. If the software is not mission-critical, deactivation is the safest course of action.

Proactive Monitoring: Monitor database query logs for suspicious syntax or unexpected patterns associated with the User parameter in global.php. Review web server access logs for anomalous requests targeting this specific endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the application. Ensure that database service accounts are restricted to the minimum privileges necessary to function.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up published on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability poses a clear and present risk to any organization running the Wedding Reservation Management System version 1.0. Organizations must prioritize isolating the affected system from public networks immediately to prevent exploitation while awaiting further remediation guidance from the vendor.