An unauthenticated SQL injection vulnerability in Campcodes Online Flight Booking Management System 1.0 allows remote attackers to compromise database integrity.

This is a SQL injection vulnerability occurring within the admin/ajax.php file. An unauthenticated remote attacker can manipulate the Username argument to execute unauthorized database queries.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation allows an attacker to bypass authentication mechanisms, potentially leading to unauthorized data access, modification, or full administrative takeover of the system. This poses a significant threat to the confidentiality and integrity of flight booking data.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the administrative login interface. If possible, disable the vulnerable component until a vendor-supplied update is released.

Proactive Monitoring: Monitor web server logs for suspicious activity targeting the /admin/ajax.php endpoint, specifically looking for SQL syntax patterns or anomalies in the Username parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the login interface.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided via the referenced vulnerability database.

This vulnerability represents a significant security risk due to the ease of exploitation and the critical nature of the authentication bypass. Organizations utilizing this system must prioritize restricting external access to the affected login files immediately. Monitor vendor communications closely for the release of an official security patch to address the underlying injection flaw.