A manipulation of the ID argument within /admin/manage_booking.php allows execution of arbitrary SQL statements leading to potential data exfiltration or modification. The flaw can compromise both confidentiality and integrity by exposing sensitive event and booking information or altering database contents. Because the injection occurs at the database layer, the damage can extend to any data stored by the application.

The vulnerability exists in itsourcecode Event Management System version 1.0, specifically within the manage_booking.php file. The affected function is not publicly named, but the ID parameter is the entry point for exploitation.

The condition has a CVSS score of 6.9, indicating moderate severity. The EPSS score is less than 1%, suggesting exploitation probability is currently low, but the exploit is publicly available and can be launched from any remote source that can reach the web interface. It is not listed in the CISA KEV catalog, yet the public availability of the exploit emphasizes the need for immediate remediation. The attack vector is inferred to be network‑based, requiring access to the management interface over HTTP/HTTPS.