A critical SQL injection vulnerability in SourceCodester Hotel Management System 1.0 allows unauthenticated attackers to execute arbitrary database queries and compromise system data.

This is a SQL injection flaw (CWE-89) located in the /index.php/reservation/check file. The application fails to properly sanitize the room_type POST parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands directly into database queries.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, potentially leading to the leakage of sensitive guest or administrative information. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which could result in severe reputational damage and regulatory non-compliance.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict access to the affected /index.php/reservation/check endpoint or implement strict input validation on the room_type parameter. Users are strongly advised to transition to a more secure, actively maintained hotel management solution.

Proactive Monitoring: Review database access logs for anomalous query patterns, specifically looking for SQL keywords or signs of error-based or time-based blind injection attempts. Monitor for unusual spikes in database traffic originating from the reservation check module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns in HTTP POST requests. Ensure that the database service account is configured with the least privilege necessary to operate, preventing broad impact if a breach occurs.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

Given the availability of a public exploit and the lack of a vendor-provided patch, this vulnerability poses an immediate threat to any organization hosting this software. Administrators must prioritize the implementation of compensating controls or network-level restrictions to isolate the vulnerable application until a secure alternative is deployed.