EUVD-2025-18833CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, was found in code-projects Online Hotel Reservation System 1.0. This affects an unknown part of the file /reservation/demo.php. The manipulation of the argument Start leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6457 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0 affecting the /reservation/demo.php file, where the 'Start' parameter is unsanitized and directly used in database queries. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete sensitive database content including guest information, reservations, and payment data. The vulnerability has been publicly disclosed with exploit code available, though specific EPSS probability and KEV/CISA inclusion status cannot be determined from provided data.
Technical Context
The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output) in a PHP-based hotel reservation system. The /reservation/demo.php endpoint accepts user input via the 'Start' parameter without proper parameterized queries or input validation/sanitization. PHP applications using concatenated SQL strings or insufficient escaping (lacking prepared statements with bound parameters) are susceptible. The affected product is code-projects Online Hotel Reservation System version 1.0, typically CPE would be: cpe:2.3:a:code-projects:online_hotel_reservation_system:1.0:*:*:*:*:*:*:*. The root cause is the failure to neutralize SQL metacharacters before passing user input to database query constructors, allowing attackers to inject arbitrary SQL commands.
Affected Products
- product: code-projects Online Hotel Reservation System; version: 1.0; affected_component: /reservation/demo.php; vulnerable_parameter: Start; cpe: cpe:2.3:a:code-projects:online_hotel_reservation_system:1.0:*:*:*:*:*:*:*; vendor_status: No vendor advisory or patch information provided in available data
Remediation
Patching: Upgrade to a patched version above 1.0 if available. Check code-projects official repository or project page for security releases. NOTE: No specific patch version identified in provided data—vendor contact or security advisory required. Code-Level Mitigation: Replace all SQL string concatenation in /reservation/demo.php with prepared statements using parameterized queries (PHP mysqli_prepare() or PDO prepared statements). Example: Use $mysqli->prepare('SELECT * FROM reservations WHERE start_date = ?') with bound parameters instead of SELECT * FROM reservations WHERE start_date = ' . $_GET['Start'] . ' Input Validation: Implement strict whitelist validation on 'Start' parameter: validate date format (YYYY-MM-DD), range checks, and type enforcement before use in any query or output context. WAF/IDS Mitigation: Deploy Web Application Firewall (WAF) rules to block common SQL injection patterns in the Start parameter (e.g., detect single quotes, SQL keywords like UNION, OR, semicolons). This is a temporary measure pending patching. Access Control: Restrict access to /reservation/demo.php at network level if it is demo/development code that should not be production-facing. Consider moving to non-public testing environment.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today