Online Hotel Reservation System CVE-2025-6457

CVSS 7.3 (Medium-High) with AV:N/AC:L/PR:N/UI:N indicates high exploitability: network-accessible, no authentication required, low attack complexity, and no user interaction needed. However, this score reflects only confidentiality (C:L), integrity (I:L), and availability (A:L) impacts—partial rather than complete compromise. The publicly disclosed POC and active disclosure significantly increase real-world risk despite the CVSS not reaching 'critical' (8.0+). Without EPSS data, exploitation probability is difficult to quantify precisely, but the combination of trivial network access, no privileges required, public POC, and SQL injection's ease of automation suggests HIGH practical risk. This is not a false-alarm high-CVSS issue; it represents genuine, immediately exploitable danger to any unpatched instance. Organizations running this system should treat it as critical priority due to disclosure and exploitability, even if CVSS is moderately scored.

An attacker discovers the vulnerable Online Hotel Reservation System 1.0 instance via search engine or reconnaissance. They craft a malicious HTTP request to /reservation/demo.php with a payload in the Start parameter, such as: GET /reservation/demo.php?Start=2025-01-01' OR '1'='1 or Start=2025-01-01'; DROP TABLE reservations; --. Because AC:L and PR:N, no authentication or special setup is required—the request is sent directly. The PHP application concatenates this unsanitized input into a SQL query without parameterization. The injected SQL executes in the database context, allowing the attacker to: (1) bypass date filters and extract all reservation records, guest PII, and payment information via UNION-based injection; (2) modify reservation data to create fraudulent bookings; or (3) delete reservations or tables to cause availability impact. A public POC streamlines this attack, enabling script-kiddie-level exploitation. Real-world impact: guest data breach, financial fraud, system downtime, compliance violations (GDPR, PCI-DSS for payment data).