An unauthenticated SQL injection vulnerability in SourceCodester Online Hotel Reservation System 1.0 allows remote attackers to compromise backend database integrity and confidentiality.

The application is vulnerable to SQL injection via the userid parameter in the /admin/edituser.php endpoint. This flaw allows an unauthenticated attacker to inject malicious SQL queries, enabling unauthorized database access and data manipulation.

The ability for an unauthenticated attacker to execute arbitrary SQL commands poses a severe risk to business operations, including the potential for complete data exfiltration, unauthorized modification of user records, and full compromise of the application database. With a CVSS score of 7.3, this high-severity vulnerability highlights an urgent requirement for remediation to prevent unauthorized access to sensitive customer and administrative data.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /admin/ directory using network-level controls or IP allowlisting to prevent unauthenticated access.

Proactive Monitoring: Monitor web server and database logs for anomalous query patterns, specifically looking for SQL keywords or signs of automated scanning tools like sqlmap targeting the edituser.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting GET parameters to provide virtual patching until a code-level fix is implemented.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the vulnerability researcher.

Given the availability of public proof-of-concept code, the risk of exploitation is elevated. Administrators must prioritize isolating the affected system from public-facing networks and implement strict input validation or transition to parameterized database queries to resolve the root cause of this injection flaw.