CVE-2025-65125

CRITICAL
2026-01-02 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Jan 12, 2026 - 15:16 vuln.today
Public exploit code
CVE Published
Jan 02, 2026 - 15:16 nvd
CRITICAL 9.8

Tags

PHP SQLi Online Movie Booking

Description

SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive information.

Analysis

The online-movie-booking application (v5.5) by gosaliajainam contains SQL injection in movie_details.php, allowing unauthenticated attackers to extract the entire database. PoC exists. This is an open-source educational project often deployed without hardening.

Technical Context

User input in movie_details.php is concatenated directly into SQL queries without parameterization (CWE-89). This classic SQL injection allows UNION-based or blind extraction of all database contents, including user credentials and payment information if stored.

Affected Products

gosaliajainam/online-movie-booking 5.5

Remediation

Use parameterized queries for all database operations. Implement a WAF. This application should not be used in production without a thorough security review.

Priority Score

69
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +49
POC: +20

Share

CVE-2025-65125 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy