The Simple Online Hotel Reservation System version 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/edit_account.php file. It is triggered by manipulating the admin_id argument, and because the vulnerability does not require prior authentication, it is remotely exploitable by any unauthenticated attacker.

Successful exploitation of this SQL injection vulnerability allows unauthorized actors to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this represents a significant security risk that could result in the compromise of sensitive administrative accounts and reservation data. Such an incident could lead to severe reputational damage and the loss of customer trust.

Immediate Action: As there is no official vendor patch available, administrators should immediately restrict access to the /admin directory using network-level controls or IP allow-listing.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns, particularly those targeting the admin_id parameter in the edit_account.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until a permanent fix is released.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

The presence of a public proof-of-concept significantly increases the likelihood of exploitation by automated scanners and malicious actors. Organizations currently running version 1.0 of the Simple Online Hotel Reservation System must treat this as a high-priority risk. If the software cannot be patched or adequately protected by compensating controls, it should be taken offline until a secure version is verified and deployed.