An unauthenticated remote SQL injection vulnerability in the FantasticLBP Hotels Server poses a significant risk to data integrity and system confidentiality.

The application fails to properly sanitize the pickedHotelName parameter within the /controller/api/hotelList.php file, which is directly processed in SQL queries. This allows an unauthenticated attacker to execute arbitrary SQL commands against the database.

Successful exploitation of this flaw can lead to unauthorized database access, sensitive data exfiltration, and potential system compromise. Given the CVSS score of 7.3, this is a high-severity issue that could result in significant business disruption and loss of customer data confidentiality, as the attack vector requires no authentication.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /controller/api/hotelList.php endpoint via network controls or a Web Application Firewall.

Proactive Monitoring: Monitor database query logs for unusual time-based delays or patterns indicative of automated SQL injection tools such as sqlmap.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block malicious SQL injection payloads targeting the pickedHotelName parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub issue referenced by the CVE record.

Due to the availability of a public exploit and the lack of a vendor-supplied patch, organizations running this software must prioritize the implementation of compensating controls. Immediate action should be taken to block access to the vulnerable API endpoint to prevent unauthorized database manipulation until the vendor provides a formal fix.