A critical SQL injection vulnerability in the FantasticLBP Hotels Server allows unauthenticated remote attackers to compromise database integrity and access sensitive data.

This is a SQL injection flaw located in the /controller/api/OrderList.php file, where the telephone parameter is processed without proper sanitization. The vulnerability is exploitable by an unauthenticated attacker, as no login or authorization is required to reach the affected endpoint.

Successful exploitation of this vulnerability enables attackers to gain unauthorized access to the underlying database, leading to potential sensitive data leakage, data tampering, or full system compromise. Given the CVSS score of 7.3, this represents a significant risk to business continuity and data privacy, as it allows for the manipulation of order information and unauthorized database interactions.

Immediate Action: Since a formal patch is currently unavailable, administrators should restrict access to the /controller/api/OrderList.php endpoint via network controls or a Web Application Firewall.

Proactive Monitoring: Review web server and database access logs for anomalous requests containing SQL syntax patterns or unexpected characters within the telephone parameter.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block SQL injection payloads targeting the specified API endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub issue (https://github.com/navex2/CVE/issues/3).

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability necessitates urgent attention. Security teams should implement strict input validation and restrict public access to the vulnerable API endpoint immediately. As the vendor has not provided a patch, continuous monitoring for malicious activity is essential until a secure version is released.