A critical SQL injection vulnerability in Campcodes Online Hotel Reservation System 1.0 allows unauthenticated remote attackers to compromise the application database.

The application is vulnerable to SQL injection (CWE-89) within the /admin/index.php file. An unauthenticated remote attacker can manipulate the username and password arguments to inject malicious SQL commands.

This vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation allows an attacker to interact directly with the backend database, which may lead to unauthorized data access, modification, or potential administrative account takeover, causing significant reputational and operational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting to prevent unauthenticated access.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /admin/index.php containing SQL syntax characters, such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the vendor releases an update.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue at https://github.com/XiaoJiesecqwq/sql/issues/1.

Due to the lack of an official patch and the public disclosure of a proof-of-concept, this vulnerability poses an immediate risk to any exposed instances. Security teams must prioritize isolating the administrative login portal and implementing WAF protections immediately to prevent exploitation.