Online Hotel Reservation System CVE-2025-6456

This vulnerability presents a HIGH real-world risk despite a CVSS score of 7.3 (High, not Critical as mislabeled in description). Multiple risk signals converge: (1) CVSS 7.3 indicates remote, unauthenticated, low-complexity exploitation with confidentiality, integrity, and availability impact—all maximum values; (2) Public exploit availability dramatically increases real-world exploitation probability; (3) The vulnerability affects a reservation system handling payment and personal customer data; (4) No authentication required (PR:N in CVSS vector) makes mass exploitation trivial; (5) The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-reachable exploitation without user interaction. This is NOT a low-risk, high-CVSS edge case—it is a genuinely dangerous vulnerability. Organizations running this software face immediate, reliable exploitation risk from automated tools and opportunistic attackers. Estimated EPSS would likely exceed 85-95% given public POC availability.

An attacker discovers a hotel's website running Online Hotel Reservation System 1.0. They navigate to the booking form and identify the 'Start' parameter in /reservation/order.php (via browser inspection or direct HTTP request testing). The attacker crafts a malicious request: GET /reservation/order.php?Start=2025-01-01' OR '1'='1'-- or POST request with Start parameter containing SQL injection payload. The vulnerable application concatenates this into a SQL query without sanitization, causing the SQL parser to execute the injected command. In a realistic scenario: (1) Attacker extracts customer data (names, contact info, payment details) via UNION-based injection; (2) Attacker modifies reservation records to create fake bookings or cancel legitimate ones; (3) Attacker escalates to remote code execution if database user has FILE privileges, writing a webshell to the server. Public POC tools automate this process, enabling non-skilled attackers to compromise the system in minutes. A hotel operator would face data breach liability, loss of bookings, and reputational damage.