Hotel and Lodge Management System
CVE-2025-11471
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No authentication required, straightforward injection; low impact across all dimensions due to limited data exposure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /edit_customer.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
AnalysisAI
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /edit_customer.php endpoint. Exploit code is publicly available, though EPSS suggests low exploitation probability (0.03%). The vulnerability can lead to unauthorized data modification or exfiltration with low impact on confidentiality, integrity, and availability.
Technical ContextAI
The affected PHP-based web application fails to properly neutralize special elements when constructing SQL queries, leading to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The /edit_customer.php script uses the 'ID' parameter directly in a database query without parameterization or input validation. The CPE identifier (cpe:2.3:a:nikhil-bhalerao:hotel_and_lodge_management_system:1.0) confirms the exact product and version.
RemediationAI
No vendor-released patch has been identified at the time of analysis. As a primary fix, upgrade to a patched version of the software if one becomes available from the developer. In the absence of a patch, implement input validation and use parameterized queries (prepared statements) to avoid SQL injection. Apply a Web Application Firewall (WAF) rule to block SQL injection patterns targeting the /edit_customer.php endpoint. If the edit customer functionality is not essential, disable access to the endpoint or restrict it to authenticated, trusted users only. These mitigations may affect normal operations but reduce the attack surface.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today