The vulnerability is a classic SQL injection flaw that permits an attacker to inject and execute arbitrary SQL statements against the underlying database. Because the flaw is not protected by authentication, any remote client that can reach the exposed endpoint can read, modify, or delete records, thereby violating confidentiality, integrity, and potentially availability of the application data. This aligns with CWE-89, the noted weakness for improper handling of untrusted input in SQL queries.

The affected product is the Travel Agency Management System from Win Men Intermational. Specific version details are not listed, so any installed instance could be vulnerable unless a vendor-issued fix has been applied.

The CVSS score of 9.3 signals a severe risk. The EPSS score is not available, but the absence of a KEV listing does not reduce the threat because exposure is remote and unauthenticated. Attackers can target the publicly accessible endpoint and send crafted requests that execute SQL on the database, enabling data theft, destruction, or alteration. The lack of authentication further lowers the barrier to exploitation and increases the likelihood that a successful attack will occur.