A remote SQL injection vulnerability in code-projects AVL Rooms 1.0 poses a significant risk of unauthorized database access and potential data manipulation.

This vulnerability is a SQL injection (CWE-89) located in the city.php file, triggered by improper neutralization of special elements in the city argument. The attack vector is network-based and requires no authentication, allowing an unauthenticated remote attacker to manipulate database queries.

Successful exploitation allows an attacker to interact directly with the application database, potentially leading to unauthorized data extraction, modification, or deletion. Given the CVSS score of 7.3, this high-severity flaw exposes sensitive information and could compromise the integrity of the entire application environment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected web directory or disable the vulnerable city.php functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for suspicious input patterns in the city parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or common SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the city parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability disclosure.

The presence of a public proof-of-concept elevates the risk of this vulnerability to an immediate concern. Organizations utilizing AVL Rooms 1.0 must prioritize the implementation of WAF filtering or network segmentation to mitigate the risk of remote exploitation while awaiting a formal security update from the vendor.