EUVD-2025-18879
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability classified as critical was found in code-projects Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /messageexec.php. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6455 is a SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, specifically in the /messageexec.php file where the 'Name' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.
Technical Context
The vulnerability exists in a web application parameter handling layer (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly associated with SQL injection). The /messageexec.php endpoint accepts user-supplied input via the 'Name' parameter without proper input validation or parameterized query usage. This allows attackers to inject arbitrary SQL syntax into backend database queries. The affected product is a PHP-based hotel reservation management system running on typical LAMP/LEMP stacks. The root cause is insufficient input filtering before SQL query construction, a preventable weakness through prepared statements or input validation.
Affected Products
code-projects Online Hotel Reservation System version 1.0 is the confirmed affected product. No CPE string was provided in the source data, but the application would typically be identified as: vendor=code-projects, product=online-hotel-reservation-system, version=1.0. The vulnerability is specific to the /messageexec.php endpoint. No other versions or products were explicitly mentioned as affected or patched in the available information.
Remediation
Immediate actions: (1) Apply parameterized queries (prepared statements) to the /messageexec.php file—replace string concatenation in SQL queries with placeholder-based parameterized queries in PHP (mysqli_prepare or PDO prepared statements); (2) Implement input validation on the 'Name' parameter using whitelist-based validation and type checking; (3) Apply principle of least privilege to database user credentials used by the application; (4) Deploy Web Application Firewall (WAF) rules to detect/block common SQL injection patterns in the Name parameter. Contact code-projects for vendor-provided patches; if unavailable, apply temporary access controls to /messageexec.php pending patch release. Monitor for active exploitation attempts in access logs.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today