An unauthenticated SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability is a SQL injection flaw located in the /admin/operations/packages.php file, where the pname argument fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw remotely to interact with the underlying database.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication, access sensitive information, or modify data within the tour and travel management database. With a CVSS score of 7.3, this represents a high-severity risk that could lead to full compromise of the application data and potential disruption of business operations.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements until a vendor-supplied update is released.

Proactive Monitoring: Security teams should audit web server access logs for anomalous requests containing SQL syntax or unusual parameters directed at the packages.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection patterns targeting the identified vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue (https://github.com/zzb1388/cve/issues/36).

Given the availability of a public proof-of-concept and the lack of a verified patch, this vulnerability presents an immediate risk to any exposed instance of the Online Tour and Travel Management System. Organizations must prioritize restricting network access to the application and implement WAF filtering to mitigate the risk of exploitation while awaiting a formal fix from the vendor.