A critical SQL injection vulnerability in the itsourcecode Online Tour and Travel Management System 1.0 allows for remote unauthorized database manipulation.

This vulnerability is a SQL injection (CWE-89) flaw located in the /admin/approve_user.php file. It allows an unauthenticated remote attacker to inject malicious SQL commands by manipulating the ID parameter.

The ability to perform SQL injection poses a significant risk to the integrity and confidentiality of the underlying database. Successful exploitation could lead to unauthorized data access, modification of user records, or potential administrative account compromise, resulting in significant reputational and operational damage. Given the CVSS score of 7.3, this represents a high-severity risk that demands immediate attention.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using network-level controls or IP allowlisting.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for unusual characters or SQL syntax in requests directed toward the /admin/approve_user.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

The presence of a public proof-of-concept for this SQL injection vulnerability significantly lowers the barrier for entry for malicious actors. IT administrators must prioritize isolating the affected application components and implementing strict access controls immediately to prevent unauthorized database interaction. Given the absence of a vendor-provided patch, users should consider the software insecure until a formal update is released and verified.