A critical SQL injection vulnerability in Campcodes Online Flight Booking Management System 1.0 exposes the application to remote database manipulation and unauthorized data access.

This flaw is a SQL injection vulnerability (CWE-89) located in the flights.php script. An unauthenticated remote attacker can manipulate the departure_airport_id argument to execute malicious SQL queries against the backend database.

The ability to perform SQL injection allows an attacker to bypass authentication, extract sensitive customer booking information, or modify database contents. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially leading to regulatory non-compliance and loss of customer trust.

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the affected flights.php file or disable the booking system until a secure version is released.

Proactive Monitoring: Security teams should audit web server access logs for anomalous SQL syntax, such as UNION, SELECT, or SLEEP commands, originating from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious payloads targeting the departure_airport_id parameter.

Public Exploit Available: Yes, a published PoC exists, as documented in the technical write-up provided via the VulDB reference.

The vulnerability in the Online Flight Booking Management System presents a clear and immediate risk due to the availability of proof-of-concept code. Organizations using this software must prioritize the implementation of compensating controls, such as WAF rules, and maintain heightened monitoring until the vendor provides a security update to address the SQL injection flaw.