Is there a public PoC exploit available for CVE-2025-8381?

Yes, a public proof-of-concept exploit is available for CVE-2025-8381. Prioritise patching immediately. EPSS: 0.1%.

Campcodes Online Hotel Reservation System CVE-2025-8381

Q: What is the CVSS score of CVE-2025-8381?

CVE-2025-8381 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-31 cna@vuldb.com

PHP SQLi Online Hotel Reservation System Campcodes

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:19 vuln.today

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in Campcodes Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /add_reserve.php. The manipulation of the argument room_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Campcodes Online Hotel Reservation System 1.0 via the room_id parameter in /add_reserve.php allows authenticated remote attackers to execute arbitrary SQL queries, but CVSS 2.1 and EPSS 0.07% (20th percentile) indicate minimal real-world risk despite public exploit availability. The vulnerability requires valid user authentication and produces only low confidentiality, integrity, and availability impact-inconsistent with the 'critical' classification in the initial report.

Technical ContextAI

The vulnerability exists in PHP-based hotel reservation software where user input (room_id parameter) is processed in /add_reserve.php without proper parameterization or input validation before being embedded into SQL queries. This instantiates CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component-'Injection'), a class covering SQL injection attacks. The affected product is Campcodes Online Hotel Reservation System version 1.0, identified by CPE cpe:2.3:a:campcodes:online_hotel_reservation_system:1.0. The attack vector is network-based but requires prior authentication (CVSS PR:L), limiting the threat surface to existing users or accounts.

RemediationAI

Contact Campcodes for patched version availability; no specific patch version is published in vendor advisories reviewed. As immediate mitigation, implement input validation and parameterized queries (prepared statements) in /add_reserve.php for the room_id parameter to neutralize SQL injection; code review of all database queries in the reservation module is strongly recommended. If vendor patch is unavailable, restrict access to /add_reserve.php via Web Application Firewall (WAF) rules that block SQL metacharacters in the room_id parameter, or limit reservation functionality to administrators only by enforcing stricter role-based access controls. Upgrade to a patched version once released; monitor https://www.campcodes.com/ for security updates.