The itsourcecode Online Tour and Travel Management System is vulnerable to a remote SQL injection attack, which could allow an unauthenticated attacker to compromise backend database integrity.

This vulnerability is a SQL injection (CWE-89) flaw located in the /admin/operations/travellers.php file. It is triggered by the manipulation of the val-username argument, and it can be exploited by an unauthenticated remote attacker.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive traveler or administrative data stored within the system database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially resulting in unauthorized data exfiltration or system manipulation that could disrupt business operations.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/operations/travellers.php, specifically looking for SQL syntax patterns within the val-username parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads directed at the vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the CVE record and the available public repository.

Given the severity of this unauthenticated SQL injection vulnerability and the confirmed existence of public exploit code, immediate action is required. Organizations using the Online Tour and Travel Management System should isolate the application from public access until a vendor-supplied security update is released and verified. Prioritize the implementation of compensating controls, such as WAF filtering, to mitigate the risk of exploitation while awaiting a permanent resolution.