EUVD-2025-18764
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability has been found in SourceCodester Online Hotel Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/execeditroom.php. The manipulation of the argument userid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6355 is a critical SQL injection vulnerability in SourceCodester Online Hotel Reservation System version 1.0, specifically in the /admin/execeditroom.php file where the 'userid' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure and proof-of-concept availability significantly elevate real-world exploitation risk.
Technical Context
The vulnerability stems from improper input validation in a PHP-based administrative interface (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly manifesting as SQL injection via CWE-89). The affected endpoint /admin/execeditroom.php processes the 'userid' parameter without adequate parameterized queries or input filtering, allowing attackers to inject SQL metacharacters. SourceCodester Online Hotel Reservation System 1.0 is a web-based property management application built in PHP, likely using a backend database (MySQL/MariaDB typical for such systems). The absence of prepared statements or stored procedures in handling the userid argument creates a direct pathway for attackers to manipulate database queries.
Affected Products
- vendor: SourceCodester; product: Online Hotel Reservation System; version: 1.0; affected_component: /admin/execeditroom.php; vulnerable_parameter: userid; cpe: cpe:2.3:a:sourcecodester:online_hotel_reservation_system:1.0:*:*:*:*:*:*:*; status: unpatched
Remediation
patch: Check SourceCodester's official website or contact support for security updates
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today