A remote SQL injection vulnerability in SourceCodester Wedding Reservation Management System 1.0 poses a significant risk of unauthorized database manipulation.

This is a SQL injection vulnerability (CWE-89) affecting the insertReservation function within the function.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands via the number argument, potentially leading to unauthorized data exposure or modification.

Successful exploitation of this vulnerability could lead to the compromise of sensitive reservation data and unauthorized modification of the backend database. Given the CVSS score of 7.3, this flaw represents a high-severity risk that could result in significant data integrity loss or service disruption, particularly if the application handles sensitive customer information.

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict network access to the affected application and implement input validation on the number parameter to block SQL injection attempts.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected syntax characters or unexpected query execution times, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures targeting the application's input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently running version 1.0 of the SourceCodester Wedding Reservation Management System must prioritize the implementation of compensating controls and restrict public access to the vulnerable function immediately to prevent potential exploitation.