An unauthenticated SQL injection vulnerability in the itsourcecode Online Tour and Travel Management System poses a significant risk of unauthorized database interaction and potential data compromise.

This vulnerability is a SQL injection flaw (CWE-89) located within the /user/page-login.php file. An unauthenticated attacker can supply malicious input via the email parameter to manipulate database queries.

The ability for an unauthenticated attacker to inject arbitrary SQL commands can lead to the unauthorized disclosure or modification of sensitive application data. Given the CVSS score of 7.3, this high-severity flaw could facilitate credential theft or further unauthorized access to the underlying database, potentially resulting in significant reputational damage and loss of system integrity.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected login page via network-level controls or a Web Application Firewall (WAF) to block malicious SQL patterns.

Proactive Monitoring: Monitor server access logs for anomalous requests to /user/page-login.php, specifically identifying input strings containing SQL syntax characters such as single quotes, semicolons, or comment sequences.

Compensating Controls: Implement a WAF with strict SQL injection protection rules to sanitize or block incoming traffic targeting the vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a clear and present danger to affected deployments. Security teams should prioritize isolating the affected component and applying vendor-supplied security updates as soon as they are made available to mitigate the risk of exploitation.