Campcodes Online Hotel Reservation System CVE-2025-8381

Authentication required: attacker must possess valid credentials and be logged into the Campcodes system or have access to the /add_reserve.php endpoint through an authenticated session. The reservation module must be enabled and accessible. SQL injection succeeds only if the room_id parameter is processed directly in a SQL query without parameterization; if the application uses prepared statements or input sanitization, exploitation is prevented. Non-default configuration: this assumes the default, vulnerable application code is deployed; if the operator has already patched or applied WAF rules, exploitation fails. No evidence indicates the vulnerability affects multi-version deployments or upgrades; version 1.0 alone is confirmed vulnerable.

Multiple signals reveal disconnect between severity labels and actual exploitability. CVSS 4.0 score of 2.1 with PR:L (login required) and low impact ratings (VC:L/VI:L/VA:L) indicates a low-risk vulnerability, confirmed by EPSS 0.07% (20th percentile)-the lowest exploitation probability tier-suggesting minimal real-world targeting. Public exploit code exists (POC confirmed), yet EPSS remains extremely low, implying either the exploit is proof-of-concept only, requires application-specific knowledge, or targets a niche product with limited deployment. KEV status is not confirmed, and active exploitation in the wild is not reported. The initial 'critical' classification contradicts the 2.1 CVSS score and 20th-percentile EPSS; this appears to be a low-complexity SQL injection in an obscure application with limited attack surface due to authentication requirements. Priority should be moderate for operators of this system, but not urgent enterprise-wide.

An authenticated user (e.g., staff member with reservation privileges) supplies a malicious SQL payload in the room_id field (e.g., room_id=1' UNION SELECT ...) when submitting the /add_reserve.php form. The unvalidated input is concatenated into a SQL query and executed by the backend, allowing the attacker to exfiltrate guest data, modify reservations, or enumerate database structure. Public POC code exists on GitHub (https://github.com/XiaoJiesecqwq/sql/issues/4), but exploitation requires valid application credentials.