A critical SQL injection vulnerability in the Campcodes Online Movie Theater Seat Reservation System allows unauthenticated remote attackers to compromise the application database.

This vulnerability is caused by improper neutralization of special elements used in an SQL command (CWE-89) within the ID argument of the /admin/manage_seat.php file. The flaw is remotely exploitable by unauthenticated users, permitting arbitrary SQL command execution.

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or deletion of sensitive reservation records. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity. If the database user has elevated permissions, the impact could extend to full system compromise or unauthorized administrative access.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory using IP allowlisting or VPN requirements. If possible, disable the vulnerable component until a vendor-supplied security update is released.

Proactive Monitoring: Monitor web server access logs for anomalous HTTP requests containing SQL syntax patterns or unexpected characters targeting the /admin/manage_seat.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the referenced GitHub issue.

Due to the availability of a public proof-of-concept and the lack of authentication required to trigger the flaw, this vulnerability presents a credible risk to the platform. Organizations currently running version 1.0 should prioritize implementing compensating controls, such as WAF filtering, immediately while awaiting a formal vendor patch.