A critical SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0 exposes the application to remote, unauthenticated database manipulation.

This is a SQL injection vulnerability located in the enquiry.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the pid argument, which is processed insecurely by the application.

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure, modification, or deletion. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to the integrity and confidentiality of travel and user data stored within the system.

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable enquiry.php endpoint via network controls or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected SQL syntax characters or unauthorized attempts to access sensitive tables, which may indicate active exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting the pid parameter in HTTP requests.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

The presence of a public proof-of-concept for this SQL injection vulnerability significantly increases the risk of exploitation by malicious actors. Organizations running this software must prioritize implementing compensating controls, such as WAF filtering, to mitigate the risk until an official vendor patch is released. Immediate review of system logs is recommended to determine if unauthorized database access has already occurred.