Hotels Server
CVE-2025-14711
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with no authentication; impact limited to partial C/I/A with no scope change to other systems.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /controller/api/hotelList.php. This manipulation of the argument pickedHotelName/type causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in FantasticLBP Hotels Server's hotel listing API endpoint allows unauthenticated remote attackers to manipulate backend database queries by supplying malicious values to the pickedHotelName or type parameters in /controller/api/hotelList.php. Impact is limited - the CVSS 4.0 vector assigns low ratings across confidentiality, integrity, and availability - but the attack requires no authentication and no user interaction. A public proof-of-concept exploit exists via GitHub issues, though EPSS at 0.08% (23rd percentile) indicates negligible observed exploitation activity to date. The vendor did not respond to disclosure, and no patch has been issued.
Technical ContextAI
Hotels Server is a PHP-based hotel management and listing web application maintained by the GitHub user FantasticLBP under a rolling release strategy (CPE: cpe:2.3:a:fantasticlbp:hotels_server:*). The affected endpoint /controller/api/hotelList.php accepts user-controlled parameters - pickedHotelName and type - and incorporates them into database queries without adequate sanitization or parameterization. The assigned CWE is CWE-74 (Injection), which is the parent class; the specific weakness is CWE-89 (SQL Injection), a classic failure to separate data from code in database query construction. Because the product uses rolling releases tied to git commits rather than versioned releases, the vulnerability spans all code up to and including commit 67b44df162fab26df209bd5d5d542875fcbec1d0.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure. Deployers should apply parameterized queries or prepared statements throughout /controller/api/hotelList.php, replacing any direct interpolation of pickedHotelName and type into SQL strings. As a compensating control, deployers should place a web application firewall (WAF) rule to detect and block common SQL injection patterns in those parameters; note that WAF rules may produce false positives for hotel names containing apostrophes or special characters. Restricting public access to the /controller/api/ path to authenticated sessions only (if the application design permits) would reduce the attack surface to authorized users. Monitor the VulDB submission at https://vuldb.com/?ctiid.336428 and the project's GitHub repository for any upstream fix commits.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today