A critical SQL injection vulnerability in the Campcodes Online Flight Booking Management System allows unauthenticated attackers to remotely manipulate database queries.

The application is susceptible to SQL injection (CWE-89) within the /admin/save_airlines.php script. An unauthenticated attacker can supply malicious input via the ID argument to bypass security controls and interact directly with the backend database.

Successful exploitation of this vulnerability could lead to unauthorized data exposure, modification, or deletion within the flight booking database. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of system information, potentially resulting in service disruption or loss of sensitive user data.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin directory using network-level controls or authentication proxies.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /admin/save_airlines.php, particularly those containing SQL syntax or unusual character strings in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting administrative endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a clear and present danger to affected deployments. Security teams should prioritize restricting external access to the administrative interface and implement strict input validation at the WAF level until the vendor releases a secure version of the software.