Is there a public PoC exploit available for CVE-2025-11401?

Yes, a public proof-of-concept exploit is available for CVE-2025-11401. Prioritise patching immediately. EPSS: 0.0%.

Hotel and Lodge Management System CVE-2025-11401

Q: What is the CVSS score of CVE-2025-11401?

CVE-2025-11401 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-07 cna@vuldb.com

PHP SQLi Hotel And Lodge Management System Nikhil Bhalerao

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:02 vuln.today

DescriptionCVE.org

A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /pages/save_curr.php. This manipulation of the argument currcode causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the currcode parameter in /pages/save_curr.php, enabling arbitrary SQL query execution with limited confidentiality and integrity impact. CVSS 2.1 reflects the authentication requirement (PR:L) and restricted scope, but publicly available exploit code exists despite low EPSS score (0.03%), suggesting this is a low-priority threat suitable only for defense-in-depth and secure coding reviews rather than emergency patching.

Technical ContextAI

The vulnerability is a SQL injection (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in a PHP-based hotel management application. The /pages/save_curr.php script fails to properly sanitize or parameterize the currcode input parameter before incorporating it into SQL queries. This allows an authenticated user to craft malicious input containing SQL metacharacters (e.g., single quotes, UNION operators) to alter query logic, extract data, or modify database contents. The CPE cpe:2.3:a:nikhil-bhalerao:hotel_and_lodge_management_system:1.0 identifies the exact affected product and version developed by Nikhil Bhalerao.

RemediationAI

No vendor-released patch identified at time of analysis - SourceCodester has not published an official update for version 1.0 addressing CVE-2025-11401. Organizations should contact the vendor at https://www.sourcecodester.com/ to inquire about patch availability or migration to a newer version. As immediate compensating controls, restrict database account permissions used by /pages/save_curr.php to read-only or least-privilege operations (limiting data an attacker can modify), implement database query logging to detect suspicious SQL patterns, use Web Application Firewall (WAF) rules to block requests containing SQL metacharacters in the currcode parameter, and enforce principle of least privilege by auditing which users have access to the system. If upgrading is necessary, validate the upgrade path with the vendor. Given the low EPSS and authentication requirement, patching can be scheduled in regular maintenance windows rather than emergency change control.