Is there a public PoC exploit available for CVE-2025-8382?

Yes, a public proof-of-concept exploit is available for CVE-2025-8382. Prioritise patching immediately. EPSS: 0.1%.

Campcodes Online Hotel Reservation System CVE-2025-8382

Q: What is the CVSS score of CVE-2025-8382?

CVE-2025-8382 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-31 cna@vuldb.com

PHP SQLi Online Hotel Reservation System Campcodes

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:19 vuln.today

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in Campcodes Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/edit_room.php. The manipulation of the argument room_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Campcodes Online Hotel Reservation System 1.0 allows authenticated remote attackers to manipulate the room_id parameter in /admin/edit_room.php, enabling data exfiltration and modification with low impact. The vulnerability requires valid login credentials (PR:L) and carries a CVSS 2.1 score reflecting limited scope; however, the public exploit disclosure and EPSS percentile 20 suggest limited real-world exploitation interest despite active availability of proof-of-concept code.

Technical ContextAI

Campcodes Online Hotel Reservation System is a PHP-based hotel management application. The vulnerability resides in the /admin/edit_room.php endpoint, which fails to properly sanitize the room_id parameter before incorporating it into SQL queries, violating CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The SQL injection occurs in an admin-facing function, requiring prior authentication. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning the injection payload requires no special conditions beyond valid admin credentials.

RemediationAI

Update Campcodes Online Hotel Reservation System to a patched version released by the vendor; consult https://www.campcodes.com/ for availability and upgrade instructions, as no specific patch version was identified from vendor advisory data. If an immediate patched version is unavailable, implement these compensating controls: (1) restrict direct access to /admin/edit_room.php via web application firewall (WAF) rules, blocking requests containing SQL metacharacters (semicolon, single quote, double dash) in the room_id parameter-note this may block legitimate room IDs if they contain such characters; (2) enforce strong, unique admin credentials and implement account lockout after failed login attempts to reduce the risk of credential compromise; (3) apply input validation at the application level to ensure room_id contains only expected numeric or alphanumeric values before query execution; (4) enable SQL query logging and monitor for suspicious room_id patterns (e.g., UNION, SELECT). Contact the vendor at cna@vuldb.com or https://www.campcodes.com/ for official patch status and timeline.