An unauthenticated SQL injection vulnerability in the itsourcecode Online Tour and Travel Management System could allow remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw located within the email parameter of the /admin/page-login.php endpoint. The issue is remotely exploitable by an unauthenticated attacker, as it resides in the login processing logic.

The ability for an unauthenticated attacker to inject malicious SQL commands poses a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this flaw enables unauthorized data access or modification, which could lead to a compromise of user credentials or sensitive travel records and potentially result in severe reputational damage.

Immediate Action: Since no official patch is available, organizations should restrict network access to the /admin/page-login.php endpoint to trusted IP addresses only.

Proactive Monitoring: Monitor web server access logs for anomalous request patterns targeting the email parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote exploitation, administrators must take immediate defensive action. Until an official vendor patch is released, ensure that the application is shielded by a WAF and restrict administrative access to authorized network segments to mitigate the risk of unauthorized data exposure.