EUVD-2025-18879Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability classified as critical was found in code-projects Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /messageexec.php. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-6455 is a SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, specifically in the /messageexec.php file where the 'Name' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.
Technical ContextAI
The vulnerability exists in a web application parameter handling layer (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly associated with SQL injection). The /messageexec.php endpoint accepts user-supplied input via the 'Name' parameter without proper input validation or parameterized query usage. This allows attackers to inject arbitrary SQL syntax into backend database queries. The affected product is a PHP-based hotel reservation management system running on typical LAMP/LEMP stacks. The root cause is insufficient input filtering before SQL query construction, a preventable weakness through prepared statements or input validation.
RemediationAI
Immediate actions: (1) Apply parameterized queries (prepared statements) to the /messageexec.php file—replace string concatenation in SQL queries with placeholder-based parameterized queries in PHP (mysqli_prepare or PDO prepared statements); (2) Implement input validation on the 'Name' parameter using whitelist-based validation and type checking; (3) Apply principle of least privilege to database user credentials used by the application; (4) Deploy Web Application Firewall (WAF) rules to detect/block common SQL injection patterns in the Name parameter. Contact code-projects for vendor-provided patches; if unavailable, apply temporary access controls to /messageexec.php pending patch release. Monitor for active exploitation attempts in access logs.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today