Which versions of PHP are affected by CVE-2025-6451?

A SQL injection vulnerability in the Simple Online Hotel Reservation System's admin panel allows remote attackers to compromise the database without authentication.

Is there a public PoC exploit available for CVE-2025-6451?

Yes, a public proof-of-concept exploit is available for CVE-2025-6451. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6451?

Within 24 hours: Disable or restrict access to /admin/delete_pending.php via network controls or WAF rules; audit logs for exploitation attempts. Within 7 days: Conduct a database security assessment and implement input validation patches manually if vendor patch remains unavailable; consider replacing the vulnerable application with a supported alternative. Within 30 days: Complete application remediation or migration; perform full security assessment of all admin interfaces; enforce multi-factor authentication on all administrative accounts.

PHP CVE-2025-6451

Q: What is the CVSS score of CVE-2025-6451?

CVE-2025-6451 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18831 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-22 cna@vuldb.com

PHP SQLi Simple Online Hotel Reservation System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 21:55 euvd

EUVD-2025-18831

Analysis Generated

Mar 15, 2026 - 21:55 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 22, 2025 - 02:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete_pending.php. The manipulation of the argument transaction_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

AnalysisAI

CVE-2025-6451 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/delete_pending.php file where the transaction_id parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion of the hotel reservation database. Public exploit disclosure and active threat indicators suggest this vulnerability warrants immediate patching.

Technical ContextAI

This vulnerability exploits improper input validation in PHP-based web application code, specifically in the administrative delete_pending.php endpoint. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating that user-supplied transaction_id parameters are passed directly to SQL queries without parameterized statements or proper escaping. The vulnerable code likely constructs SQL queries using string concatenation (e.g., SELECT * FROM transactions WHERE transaction_id = '$_GET[transaction_id]') rather than prepared statements. Affected product: code-projects Simple Online Hotel Reservation System 1.0 (CPE context: hotel reservation management software written in PHP).