EUVD-2025-18711
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in code-projects Hostel Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /empty_rooms.php. The manipulation of the argument search_box leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6296 is a critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /empty_rooms.php file's search_box parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially achieving unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making active exploitation highly probable in real-world deployments.
Technical Context
The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'), manifesting as SQL injection. The /empty_rooms.php file fails to properly sanitize or parameterize user-supplied input from the search_box parameter before incorporating it into SQL queries. This is a classic web application input validation failure where unsanitized user input is concatenated directly into SQL statements. The affected product is code-projects Hostel Management System, a PHP-based web application (CPE identifier would be cpe:2.3:a:code-projects:hostel_management_system:1.0:*:*:*:*:*:*:*), suggesting the vulnerability affects PHP-based database operations, likely interfacing with MySQL or similar relational databases commonly used in PHP applications.
Affected Products
- product: code-projects Hostel Management System; versions: ['1.0']; cpe: cpe:2.3:a:code-projects:hostel_management_system:1.0:*:*:*:*:*:*:*; affected_component: /empty_rooms.php (search_box parameter); deployment_context: PHP-based web application, typically deployed on Apache/Nginx with MySQL backend
Remediation
Contact code-projects vendor for security update or patch version >1.0. Monitor vendor website/repository for patches.; timeline: Apply immediately upon availability (Critical severity) Workaround - Input Validation: Implement strict whitelist validation for search_box parameter. Only allow alphanumeric characters and spaces. Reject special characters including quotes, dashes, parentheses, and SQL keywords. Workaround - Parameterized Queries: Refactor /empty_rooms.php to use prepared statements/parameterized queries (PDO or MySQLi prepared statements in PHP) instead of string concatenation for all database interactions. Workaround - WAF Rules: Deploy Web Application Firewall (ModSecurity, AWS WAF, Cloudflare) with SQL injection detection rules targeting /empty_rooms.php. Block requests containing SQL keywords and union statements in search_box parameter. Workaround - Database Permissions: Configure database user account for the application with minimal privileges (SELECT-only on necessary tables, no DROP/ALTER). This limits blast radius if SQL injection succeeds. Detection/Monitoring: Implement SQL query logging and anomaly detection. Monitor for unusual query patterns, error-based SQL injection attempts, or unexpected table/column access from the application account.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today