Online Hotel Reservation System CVE-2025-8378

The /admin/index.php login page must be reachable over a network by the attacker - in typical deployments this means internet exposure, as the application is designed as a web-based hotel management portal. No authentication is required prior to exploitation; the injection point is the pre-authentication login form itself (username and password POST parameters). The target must be running exactly Campcodes Online Hotel Reservation System version 1.0 as a PHP application with a backend SQL database. No non-default configuration is required - vulnerability exists in the default installation. Exploitation is bounded to this specific product and version; no lateral applicability to other Campcodes products is indicated by available data.

The CNA-assigned CVSS 4.0 score of 5.5 with VC:L/VI:L/VA:L appears conservative for a pre-authentication SQL injection on an admin login page - auth bypass and full database read are realistic outcomes that typically warrant higher impact ratings. The network vector (AV:N), no complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N) represent worst-case access conditions. Against this, EPSS at 0.07% (21st percentile) and absence from CISA KEV both indicate limited observed active exploitation, most likely reflecting the narrow real-world deployment footprint of Campcodes software rather than technical difficulty. The E:P modifier in the provided vector confirms public exploit code exists, which is a meaningful escalation signal for any exposed instance. Overall: low aggregate risk due to niche prevalence, but high per-instance risk for any organization actually running this system internet-facing.

An attacker discovers a Campcodes Online Hotel Reservation System instance via web search or automated scanning and sends a crafted HTTP POST to /admin/index.php with a SQL injection payload (e.g., ' OR '1'='1'--) in the username field, bypassing the authentication check and gaining administrative access to the hotel management panel. From there, the attacker can enumerate reservation records, extract guest PII, or enumerate further database contents using UNION-based or blind injection techniques. A public proof-of-concept documented on GitHub (https://github.com/XiaoJiesecqwq/sql/issues/1) makes this scenario reproducible with minimal skill.