EUVD-2025-201654Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin path requires at least low-privilege authentication (PR:L); SQL injection yields partial data read/write, so C:L/I:L/A:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. The impacted element is an unknown function of the file /admin/invoiceprint.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
AnalysisAI
SQL injection in the tushar-2223 Hotel-Management-System PHP project allows remote attackers to manipulate database queries via the ID parameter in /admin/invoiceprint.php. The affected codebase is pinned to rolling-release commit bb1f3b3, with no versioned patch available. A publicly available exploit report exists on GitHub (yaklang/IRifyScanResult), though EPSS at 0.04% (13th percentile) indicates negligible real-world exploitation activity - consistent with the project's extremely limited production footprint. No confirmed active exploitation (no CISA KEV entry).
Technical ContextAI
The affected product is a PHP-based hotel management web application hosted on GitHub under the repository tushar-2223/Hotel-Management-System. The vulnerability resides in /admin/invoiceprint.php, where the ID query parameter is passed unsanitized into a database query, constituting a classic SQL injection. The root cause is CWE-74 (Injection), with the specific sub-class being CWE-89 (SQL Injection). The application is written in PHP and presumably uses MySQL or MariaDB as its backend, which is the typical stack for open-source PHP hotel management projects of this type. No prepared statements or parameterized queries appear to be used for this endpoint. The affected version is identified by a specific Git commit hash (bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15), as the project uses rolling releases with no semantic versioning.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the project uses rolling releases with no tagged fix commit confirmed in the provided data. Operators running this codebase should manually remediate the SQL injection in /admin/invoiceprint.php by replacing direct string interpolation of the ID parameter with a parameterized query using PHP PDO or MySQLi prepared statements, which eliminates the injection vector with no functional side effects. If immediate code changes are not feasible, deploying a Web Application Firewall (WAF) rule to block SQL metacharacters in the ID parameter of requests to /admin/invoiceprint.php provides a compensating control, though WAF rules can be bypassed by sufficiently encoded payloads. Restricting network access to the /admin/ directory via IP allowlisting or HTTP authentication at the web server level significantly reduces exposure. The VulDB advisory is available at https://vuldb.com/?id.334650 and the exploit report at https://github.com/yaklang/IRifyScanResult/blob/main/Hotel-Management-System/SQL_Injection_Vulnerability_Report.md.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today