Which versions of PHP are affected by EUVD-2025-18824?

A remote SQL injection vulnerability in the Simple Online Hotel Reservation System's admin panel allows attackers to compromise the hotel database without authentication.

Is there a public PoC exploit available for EUVD-2025-18824?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18824. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18824?

Within 24 hours: Identify all systems running Simple Online Hotel Reservation System 1.0 and restrict network access to /admin/add_room.php to authorized users only. Within 7 days: Deploy WAF rules to block SQL injection payloads in the room_type parameter and implement input validation/sanitization at the application layer. Within 30 days: Evaluate alternative hotel reservation systems from vendors with active security support and plan migration; if continuing with current system, conduct code review and apply custom patches to sanitize the room_type input.

PHP EUVD-2025-18824

Q: What is the CVSS score of EUVD-2025-18824?

EUVD-2025-18824 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6420 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-21 cna@vuldb.com

PHP SQLi Simple Online Hotel Reservation System Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 21:35 euvd

EUVD-2025-18824

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

PoC Detected

Oct 23, 2025 - 20:06 vuln.today

Public exploit code

CVE Published

Jun 21, 2025 - 22:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/add_room.php. The manipulation of the argument room_type leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System version 1.0, specifically in the /admin/add_room.php file where the 'room_type' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of hotel reservation system data. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output ('Injection')) stemming from inadequate input validation and parameterized query implementation in PHP. The Simple Online Hotel Reservation System 1.0 (affected CPE would be cpe:2.3:a:code-projects:simple_online_hotel_reservation_system:1.0:*:*:*:*:*:*:*) fails to properly escape or bind the 'room_type' parameter in database queries within the administrative add_room.php endpoint. This allows attackers to inject malicious SQL syntax that bypasses intended query logic, commonly used to exfiltrate user credentials, reservation data, or administrative information from the backend database.

RemediationAI

Upgrade to the latest patched version if available from code-projects. If no patch exists, consider alternative hotel management systems. Workaround (Immediate): Implement IP whitelisting or require VPN/authentication gateway access to administrative endpoints. Code-Level Mitigation: Refactor add_room.php to use mysqli prepared statements or PDO with parameterized queries instead of string concatenation. Input Validation: Validate room_type against a predefined list of allowed room types before any database operation. Detection: Enable ModSecurity or similar WAF with OWASP ModSecurity Core Rule Set to block SQL injection attempts.