An unauthenticated SQL injection vulnerability in the SourceCodester Hotel Reservation System poses a severe risk of unauthorized database access and potential system compromise.

This is a time-based blind SQL injection flaw located in the updateabout.php file. The application fails to properly sanitize the address parameter before including it in SQL queries, allowing an unauthenticated remote attacker to inject malicious SQL payloads.

Successful exploitation allows an attacker to bypass authentication mechanisms and gain unauthorized access to the backend database. This could lead to the exposure of sensitive customer data, unauthorized modification of reservation records, and potentially full control over the application environment. Given the CVSS score of 7.3, this vulnerability represents a significant risk to data confidentiality and integrity.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict external access to the /admin/ directory and the updateabout.php endpoint immediately.

Proactive Monitoring: Review web server access logs for anomalous POST requests to updateabout.php, specifically searching for SQL syntax characters such as single quotes, semicolons, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP POST parameters.

Public Exploit Available: Yes, a proof-of-concept and technical analysis are available via the referenced GitHub repository.

Due to the availability of public exploit details and the ease of execution, this vulnerability should be prioritized for mitigation. Organizations currently utilizing this software must implement strict network-level access controls to shield the administrative interface from the public internet, as there is currently no vendor-provided patch to remediate the underlying code flaw.