Online Hotel Reservation System CVE-2025-6355

Despite the CVSS 7.3 score (High severity), multiple factors indicate substantial real-world risk: (1) Attack Vector is Network with Low Complexity and No Authentication Required—the vulnerability is trivially accessible; (2) Public exploit disclosure removes the barrier to script-kiddie-level attacks; (3) The affected system is administrative functionality, but remote unauthenticated access suggests broken access control layering this vulnerability; (4) SQL injection impacts Confidentiality, Integrity, and Availability equally (all marked as 'Low' in CVSS, but cumulative effect enables privilege escalation, data exfiltration, and account takeover); (5) Hotel reservation systems store sensitive guest PII, payment data, and booking information—high-value targets. The lack of authentication requirement is the critical differentiator; this is not a privilege escalation but a direct perimeter break. EPSS score would likely be elevated (>0.85) given public POC and ease of exploitation. This is a genuine critical priority despite CVSS 7.3.

An attacker discovers a vulnerable SourceCodester installation through public facing endpoints or reconnaissance. They craft an HTTP request to /admin/execeditroom.php with a malicious userid parameter such as: userid=1' OR '1'='1' UNION SELECT username, password FROM admin_users-- This bypasses authentication logic and exfiltrates admin credentials, enabling complete system compromise. Alternatively, userid=1; DROP TABLE bookings;-- destroys critical reservation data. Because the endpoint is unauthenticated and remotely accessible (AV:N), exploitation requires only basic HTTP client knowledge. Public POC availability means automated attack tools are likely already deployed in the wild against unpatched instances. Hotel properties running version 1.0 are immediately vulnerable upon internet exposure.