A critical SQL injection vulnerability in SourceCodester Simple Responsive Tourism Website 1.0 allows remote, unauthenticated attackers to compromise database integrity.

The vulnerability is a SQL injection (CWE-89) flaw located in the /classes/Master.php file, specifically within the register function. An unauthenticated attacker can supply malicious input via the Username parameter to execute arbitrary SQL commands.

Successful exploitation of this vulnerability permits unauthorized interaction with the application backend database. This could lead to data exfiltration, unauthorized administrative account creation, or complete loss of database confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the availability and security of the hosting environment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the registration endpoint or disable the registration functionality entirely until a secure version is released.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting /classes/Master.php containing SQL syntax characters, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns in URI parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability presents an immediate risk to any deployment of the Simple Responsive Tourism Website. Security teams must prioritize isolating the affected component and implementing strict WAF filtering to prevent exploitation until a formal update is provided by the vendor.