Is there a public PoC exploit available for CVE-2025-11474?

Yes, a public proof-of-concept exploit is available for CVE-2025-11474. Prioritise patching immediately. EPSS: 0.0%.

Hotel and Lodge Management System CVE-2025-11474

Q: What is the CVSS score of CVE-2025-11474?

CVE-2025-11474 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-08 cna@vuldb.com

PHP SQLi Hotel And Lodge Management System Nikhil Bhalerao

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:33 vuln.today

DescriptionCVE.org

A vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_booking.php. Performing manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /edit_booking.php, resulting in limited confidentiality and integrity impact. The vulnerability has public exploit code available but carries exceptionally low EPSS exploitation probability (0.03%, 8th percentile), suggesting minimal real-world threat despite network accessibility and low attack complexity.

Technical ContextAI

The vulnerability exists in PHP-based hotel management software where user-supplied input in the Name parameter of the edit_booking.php file is passed directly to a SQL query without proper sanitization or parameterized queries. This is a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) manifestation in SQL context. The affected CPE (cpe:2.3:a:nikhil-bhalerao:hotel_and_lodge_management_system:1.0) indicates this is a single-version product with no documented version inheritance or upgrade path, limiting the scope of affected deployments.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate remediation requires either upgrading to a patched version if available from the vendor at https://www.sourcecodester.com/, or removing the software from production. Compensating controls include: implement parameterized queries or prepared statements in the PHP code to neutralize SQL injection input (requires code modification or Web Application Firewall rule to block single quotes and SQL keywords in the Name parameter); restrict access to /edit_booking.php to trusted IP ranges only via network-level controls (reduces attack surface significantly since authentication is required); apply input validation to reject SQL metacharacters in the Name field (limits but does not eliminate risk without query parameterization). Web Application Firewall signatures blocking SQL injection patterns in POST/GET Name parameters can provide temporary protection while code remediation is performed.