An unauthenticated SQL injection vulnerability in the itsourcecode Free Hotel Reservation System login portal poses a severe risk of unauthorized database access and complete system compromise.

This is a SQL injection vulnerability located in the /hotel/admin/login.php file. An unauthenticated attacker can manipulate the email POST parameter to execute arbitrary SQL commands against the backend database.

Successful exploitation allows an attacker to bypass authentication, extract sensitive customer or administrative data, modify application records, or potentially gain full control over the underlying database server. Given the nature of the application as a reservation system, this could lead to significant privacy breaches and operational disruption. The CVSS score of 7.3 reflects the high potential for impact on confidentiality and integrity, despite the lower complexity of the attack.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the login portal using IP allowlisting or a VPN. If the software is not mission-critical, it should be taken offline until the vendor provides a secure update.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /hotel/admin/login.php containing SQL syntax characters, such as single quotes, RLIKE, or SLEEP commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST requests.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's write-up hosted on GitHub.

The risk posed by this vulnerability is significant due to the ease of exploitation and the potential for full database compromise. Organizations utilizing the Free Hotel Reservation System must treat this as a high priority, implement strict network-level access controls immediately, and monitor for any signs of unauthorized database interaction until a formal vendor patch is released and applied.