The Event Management System 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to manipulate backend database queries.

This is a SQL injection vulnerability (CWE-89) triggered by the improper sanitization of the ID parameter within the /admin/manage_booking.php script. The vulnerability can be exploited by an unauthenticated remote attacker.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive booking data, potential modification of records, or the exposure of administrative credentials, which may result in severe reputational damage and operational disruption. The CVSS score of 7.3 highlights the high risk associated with the ease of remote exploitation.

Immediate Action: As no vendor patch is currently available, administrators should immediately restrict access to the /admin/manage_booking.php endpoint or disable the affected module until a security update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unusual activity directed at the manage_booking.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block malicious payloads targeting the ID parameter, providing a virtual patch against common SQL injection techniques.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the GitHub issue reference.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents a clear and present danger to affected systems. Organizations must prioritize the isolation of the vulnerable application from public networks and apply the suggested WAF filtering to prevent exploitation until the vendor provides a formal remediation.