The Simple Online Hotel Reservation System 1.0 is vulnerable to unauthenticated SQL injection, which could lead to full database compromise and unauthorized system access.

This is a classic SQL injection flaw (CWE-89) located in the add_query_reserve.php file. The application fails to sanitize the room_id parameter, allowing an unauthenticated remote attacker to inject malicious SQL queries directly into the backend database.

Successful exploitation of this vulnerability allows an attacker to bypass authentication, exfiltrate sensitive reservation data, modify or delete records, and potentially gain full control over the underlying database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially resulting in severe reputational damage and legal liability regarding guest privacy.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the affected web application using network-level controls or disable the service until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to add_query_reserve.php, specifically searching for payloads containing SQL syntax such as UNION, SELECT, or SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the room_id parameter.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's GitHub write-up.

Due to the availability of public proof-of-concept code and the ease of remote exploitation, this vulnerability poses a critical risk to any organization hosting this software. Organizations should prioritize isolating the affected system from public-facing networks until a secure update is provided by the vendor, and ensure that database permissions are restricted to the absolute minimum necessary for application functionality.