The itsourcecode Free Hotel Reservation System 1.0 is vulnerable to an unauthenticated SQL injection attack that poses a severe risk of unauthorized database access and potential system compromise.

This vulnerability is a SQL injection flaw located in the start parameter of the /hotel/admin/mod_reports/index.php file. An unauthenticated attacker can supply malicious input to this parameter to manipulate backend database queries, bypassing standard application logic.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to the underlying database, which may contain sensitive customer or reservation information. Given the CVSS score of 7.3, this flaw represents a significant risk to data confidentiality and integrity. If leveraged effectively, the attacker could potentially extract sensitive data, modify records, or cause service disruption, leading to reputational damage and potential loss of business continuity.

Immediate Action: As no official patch is available, administrators should restrict network access to the /hotel/admin/ directory to trusted IP addresses only and, if possible, disable the vulnerable module entirely.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected use of RLIKE, SLEEP, or concatenation functions that indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the start parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub security issue report linked in the vulnerability references.

The severity of this SQL injection vulnerability necessitates immediate defensive measures, particularly because the software is currently lacking an official vendor-supplied patch. Organizations utilizing this system must prioritize restricting access to the administrative interface and implementing WAF protections to mitigate the risk of exploitation. We strongly recommend transitioning to a supported and actively maintained reservation system to ensure long-term security.