A critical SQL injection vulnerability in the itsourcecode Online Tour and Travel Management System 1.0 allows remote, unauthenticated attackers to compromise database integrity.

This vulnerability is a SQL injection flaw located in the /admin/disapprove_user.php file. An unauthenticated attacker can exploit this by manipulating the ID parameter to execute unauthorized database commands remotely.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive travel and user data stored within the backend database. Given the CVSS score of 7.3, this flaw presents a high risk for data exfiltration or potential administrative account compromise, which could cause significant reputational damage and regulatory non-compliance.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict access to the /admin/ directory to trusted internal IP addresses only. If the functionality is not business-critical, disable the affected script until a formal security update is provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the disapprove_user.php file, specifically looking for URL parameters containing SQL syntax or unusual character sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns in HTTP requests.

Public Exploit Available: Yes, a public proof-of-concept exists and is attributed to the research write-up hosted at the GitHub issue tracker (https://github.com/zzb1388/cve/issues/35).

Due to the availability of a public proof-of-concept and the remote, unauthenticated nature of this vulnerability, immediate defensive measures are required. Organizations should prioritize isolating the affected management system from public internet exposure and implementing strict WAF filtering to mitigate the risk of exploitation until an official patch is released.