A critical SQL injection vulnerability in PHPGurukul Park Ticketing Management System v2.0 permits remote unauthenticated attackers to compromise database integrity and confidentiality.

The flaw exists in the foreigner-bwdates-reports-details.php file, where the fromdate parameter fails to properly sanitize user-supplied input before passing it to a database query. This vulnerability is accessible to unauthenticated remote attackers.

Successful exploitation grants an attacker the ability to execute arbitrary SQL queries, which can lead to full database unauthorized access, data exfiltration, or complete system compromise. With a CVSS score of 9.8, this vulnerability poses a critical risk to business operations, potentially resulting in severe data breaches and regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected file or disable the Park Ticketing Management System until a secure update is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous POST requests to foreigner-bwdates-reports-details.php containing SQL syntax characters, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically configured to inspect and block malicious SQL injection payloads targeting the fromdate parameter in POST requests.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up referenced by the CVE record.

Given the critical nature of this vulnerability and the availability of a public proof-of-concept, immediate defensive action is required. Organizations should prioritize isolating the affected component from public access until a vendor-supplied security update is applied to remediate the underlying code vulnerability.