EUVD-2025-21185CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected is an unknown function of the file /admin/manage_theater.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7454 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, specifically in the /admin/manage_theater.php file where the ID parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the theater reservation database. The exploit has been publicly disclosed and is actively exploitable with no authentication required.
Technical Context
The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), manifesting specifically as SQL injection. The affected component is the /admin/manage_theater.php administrative interface in Campcodes Online Movie Theater Seat Reservation System 1.0. The application fails to properly sanitize or parameterize the 'ID' parameter before incorporating it into SQL queries, allowing attackers to inject malicious SQL syntax. This is a classic second-order input validation flaw where user-supplied input is directly concatenated into database query construction without using prepared statements or parameterized queries. CPE for affected product: cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:*
Affected Products
- vendor: Campcodes; product: Online Movie Theater Seat Reservation System; version: 1.0; cpe: cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:*; affected_component: /admin/manage_theater.php; affected_parameter: ID; vulnerability_type: SQL Injection (CWE-74)
Remediation
Upgrade to a patched version if available from vendor Vendor Contact: Contact Campcodes immediately for official patch status and timeline
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today