Description
A remote SQL injection vulnerability exists in PHP-RESIDENCE version 0.7.2 through the Search parameter. User input is directly incorporated into SQL queries without sanitization.
Impact
Attackers can inject arbitrary SQL commands to extract all data from the database, including reservation details, customer information, and administrative credentials.
Solution
Use parameterized queries for all search operations. Upgrade to the latest version of PHP-RESIDENCE.