An unauthenticated SQL injection vulnerability in tushar-2223 Hotel-Management-System exposes administrative databases to unauthorized access and potential system compromise.

The application fails to sanitize user input in the id parameter within the admin/invoiceprint.php file before including it in a database query. This lack of input validation, combined with a total absence of authentication checks, permits unauthenticated remote attackers to perform time-based blind SQL injection.

Successful exploitation of this vulnerability allows unauthorized actors to extract sensitive data, including customer records, payment information, and administrative credentials. This compromise could lead to full system takeover via privilege escalation or further exploitation of administrative functionality. While the CVSS score is 7.3, the potential for total database exposure and the lack of authentication mechanisms represent a significant risk to organizational data integrity and confidentiality.

Immediate Action: Since no official patch is currently available for this repository, administrators should restrict network access to the /admin/ directory and implement strict input validation for all URL parameters.

Proactive Monitoring: Monitor server access logs for anomalous GET requests targeting /admin/invoiceprint.php, particularly those containing SQL keywords or time-delay functions like SLEEP().

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, such as quote-breaking characters and database-specific function calls.

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via the referenced GitHub repository.

Given the critical nature of unauthenticated SQL injection and the availability of public proof-of-concept code, immediate action is required. Organizations utilizing this software must implement strict access controls on the administrative interface and monitor for suspicious activity until a formal fix is provided by the maintainer. Failure to secure this endpoint significantly increases the risk of data exfiltration and unauthorized administrative access.