A critical SQL injection vulnerability in the itsourcecode Online Tour and Travel Management System version 1.0 poses a significant risk of unauthorized database manipulation and information disclosure.

The application is vulnerable to SQL injection (CWE-89) via the tname argument in the /admin/operations/tax.php file, which can be exploited by an unauthenticated remote attacker.

The ability for an unauthenticated attacker to perform SQL injection attacks presents a high risk to business operations, as it may lead to the exfiltration of sensitive travel booking data or administrative credentials. With a CVSS score of 7.3, this vulnerability is categorized as High, indicating that successful exploitation could compromise the confidentiality and integrity of the underlying database.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict access to the /admin directory using network-level controls or IP allowlisting to prevent unauthorized access.

Proactive Monitoring: Security teams should monitor web server logs for anomalous HTTP requests targeting tax.php, specifically looking for SQL syntax patterns or unexpected input in the tname parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Given the public availability of exploit code and the lack of a vendor-supplied patch, this vulnerability requires immediate attention. Organizations utilizing this software must implement strict access controls and WAF protections to mitigate the risk of exploitation until a formal security update is released by the vendor.