A critical SQL injection vulnerability in the itsourcecode Free Hotel Reservation System allows unauthenticated remote attackers to compromise the underlying database.

This vulnerability is an SQL injection flaw located in the account_id parameter within the /hotel/admin/mod_users/index.php file. It allows an unauthenticated remote attacker to inject malicious SQL commands, which are then processed by the database without sufficient validation.

Successful exploitation of this vulnerability can lead to unauthorized database access, sensitive data exfiltration, and potential full system compromise. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially resulting in severe operational disruption and regulatory compliance failures.

Immediate Action: As no official patch is available from the vendor, users should restrict network access to the application or take the system offline until code-level mitigations are implemented. Developers must refactor the vulnerable code to use prepared statements and parameterized queries to neutralize the injection vector.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous query patterns, specifically looking for SQL keywords or signs of automated scanning tools like sqlmap.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the application's input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub research writeup.

Due to the lack of a vendor-provided patch and the availability of public exploit material, this vulnerability poses an immediate threat to any organization running the affected software. Organizations must prioritize either removing the application from production or implementing strict network-level access controls and WAF protections to prevent unauthorized exploitation.