Fantasticlbp
Monthly
SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
We need to construct the JSON as per the instructions, based on the provided CVE data. Let's analyze the inputs. CVE ID: CVE-2025-14711 Description: A flaw in FantasticLBP Hotels Server up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0. Unknown code in /controller/api/hotelList.php. Manipulation of argument pickedHotelName/type causes SQL injection. Attack can be carried out remotely. Exploit published. Rolling release. Vendor did not respond. CVSS Score: 5.5 (but there's a CVSS 4.0 vector provided: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... rest with X). The CVSS 4.0 base is AV:N, etc. Score 5.5 would correspond to a CVSS 3.1? But they gave CVSS:4.0 vector. Possibly they just gave a CVSS 4.0 base score of 5.5? Actually they wrote "CVSS Score: 5.5" then CVSS Vector with CVSS:4.0. That seems inconsistent. Possibly the score is from a different version. The provided vector is CVSS 4.0, and it's AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That sounds like low impact to confidentiality integrity availability. That might yield a low score. I'll trust the vector, and the score is not crucial as we are to do our own assessed CVSS vectors. I'll ignore the 5.5 score and rely on the provided CVSS 4.0 vector info. Actually the description says "SQL injection". Typically SQLi can lead to high impact (reading data, modifying). But the provided vector indicates low impact on each. That might be a conservative assessment. My own assessment: SQL injection in a hotel management system could lead to reading sensitive data (C high), maybe modifying (I high), but depending on database permissions. I need to assess based on the description. The description says "manipulation ... causes sql injection". No specifics on impact, but typical SQLi can be severe. I'll set C/I/A accordingly. Usually for SQLi, I assume confidentiality impact high (read data), integrity maybe high if writeable, availability maybe low. But I can choose. Since it's an API endpoint that might return hotel list, maybe it's select query? But parameter pickedHotelName/type might be used in a query, injection might allow arbitrary read. I'll assess with CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H? Possibly. But need to be realistic: without authentication, remote SQLi, full DB compromise likely. I'll set C:H/I:H/A:H. For CVSS 4.0, I can map similarly: VC:H/VI:H/VA:H? But the provided vector had L. I'll use my own assessment. I'll include rationale. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). SQL injection falls under CWE-89, but they gave CWE-74, a broader class. Probably it's SQLi. I'll mention SQL injection. Multi-source intelligence: - EPSS: 0.08% (percentile 23%) - low likelihood of exploitation soon. - POC/Exploit: Publicly available (yes, the description says exploit published, and references point to GitHub issues). - Reported by cna@vuldb.com. - CPE: cpe:2.3:a:fantasticlbp:hotels_server:*:*:*:*:*:*:*:* (up to that commit). - Tags: PHP, SQLi, Hotels Server. - References: two exploit links to github.com/navex2/CVE/issues/1 and /2, then vuldb entries. No KEV listed, so not in CISA Known Exploited Vulnerabilities. POC available but not confirmed active exploitation. EPSS low. Patch status: The description says "The product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way." So no patch mentioned. Input has no explicit patch version or advisory. So I'll state "No vendor-released patch identified at time of analysis." But there might be a fix around that commit? The version is "up to 67b44df162fab26df209bd5d5d542875fcbec1d0", which looks like a commit hash. So all versions before that commit might be vulnerable. Rolling release might mean there's no versioned release, just commits. The fix might be in a later commit, but we don't know. So patch unavailable. Product: FantasticLBP Hotels Server. The product_name: "Hotels Server" or "FantasticLBP Hotels Server"? The CPE says fantasticlbp:hotels_server. I'll use "FantasticLBP Hotels Server" as product name (1-3 words: "FantasticLBP Hotels Server"? That's three words. Or "Hotels Server"? I'll use "FantasticLBP Hotels Server" as precise name. It's a PHP web application for hotel management. Now craft each field: product_name: "FantasticLBP Hotels Server" (three words, but "Hotels Server" might be better? The CPE product is hotels_server, vendor fantasticlbp. So product name: "Hotels Server". However, description says "FantasticLBP Hotels Server". I'll use "HotelServer" or "Hotels Server"? The tag says "PHP, SQLi, Hotels Server". I'll go with "Hotels Server" but need to ensure it's specific. The full name is "FantasticLBP Hotels Server". I'll use "FantasticLBP Hotels Server" (3 words). Good. summary: Start with specific impact verb and product. "SQL injection in FantasticLBP Hotels Server up to commit 67b44df... allows remote unauthenticated attackers to manipulate database queries via the pickedHotelName or type parameters in /controller/api/hotelList.php." Then mention active exploitation? Not active, but POC available. EPSS low. So: "Publicly available exploit code exists, though EPSS indicates a low exploitation probability. The vendor has not responded to disclosure and no fix is available." That fits. It's original synthesis. technical_context: Underlying technology: PHP web application for hotel management. The vulnerable component is the /controller/api/hotelList.php API endpoint that handles hotel listing requests. The parameters pickedHotelName and type are likely used directly in a SQL query without proper sanitization, leading to SQL injection (CWE-89, but classified under CWE-74 broader injection). CPE confirms affected product is cpe:2.3:a:fantasticlbp:hotels_server:* up to the specified commit. This is a PHP/SQL context. risk_assessment: CVSS vector provided is CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/E:P, indicating network-accessible, no privileges required, no user interaction, but only low impact on confidentiality, integrity, availability. However, typical SQLi can be high impact. EPSS 0.08% (23rd percentile) indicates low expected exploitation activity. POC publicly available but not listed in KEV, so no known active exploitation. SSVC assessment: no active exploitation, automatable (yes, remote SQLi), technical impact potentially high (depending on DB permissions). The low EPSS and lack of KEV suggest this is not an immediate priority compared to higher-risk vulnerabilities, but the POC availability and unauthenticated nature warrant attention for exposed instances. Note that the CVSS impact rating may understate the true impact if the database is not isolated. Contrast signals: EPSS low, POC published, no KEV, unauthenticated network vector, low impact per provided CVSS but SQLi often leads to data breach. I'll state: "CVSS:4.0 vector rates impact as low, but SQL injection in a hotel management system could expose guest data, making potential real-world impact higher. EPSS score is low despite public POC, suggesting limited exploitation activity at this time." affected_products: FantasticLBP Hotels Server, all versions up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0 (rolling release, no fixed version). The CPE is cpe:2.3:a:fantasticlbp:hotels_server:*:*:*:*:*:*:*:*. No vendor advisory; references include VulDB entries and exploit GitHub issues. So: "Affects FantasticLBP Hotels Server up to and including commit 67b44df162fab26df209bd5d5d542875fcbec1d0; no official release version identifier. The product uses a rolling release model. Refer to the VulDB advisory (336428) and exploit proofs at GitHub issues #1 and #2 in the navex2/CVE repository." I'll write concisely. remediation: No vendor patch available; vendor did not respond. Suggest: "Upgrade to a later commit if one exists that fixes the SQL injection, though no fixed version is announced. As a workaround, implement input validation and parameterized queries on the affected endpoint. Consider restricting access to /controller/api/hotelList.php via web server rules until the code is fixed. Disabling the endpoint if not essential can mitigate the risk. Also, ensure the database account used by the application has minimal privileges to limit potential impact." I'll phrase naturally. exploit_scenario: An attacker sends a crafted HTTP request to /controller/api/hotelList.php with malicious SQL in the pickedHotelName or type parameter. This injects SQL commands, potentially allowing data exfiltration (e.g., guest records) or database modification. A proof of concept is publicly available on GitHub. exploitation_conditions: No complex conditions. Remote unauthenticated attack against the API endpoint is sufficient. No special configuration or authentication required. The endpoint appears to be part of the application's default functionality. There are no limiting factors beyond the accessibility of the web server. So: "No special conditions — remote unauthenticated exploitation against default installations of FantasticLBP Hotels Server with the /controller/api/hotelList.php endpoint exposed." Actually we need EXACT product feature, protocol, configuration: "The vulnerability exists in the hotelList.php API endpoint, which is accessible over HTTP(S) without authentication. No specific configuration is required; the endpoint is present in default deployments." attack_chain: "Send HTTP request to /controller/api/hotelList.php with crafted 'pickedHotelName' parameter → Inject SQL payload into database query → Execute arbitrary SQL queries → Read or modify hotel data." That's 4 steps. I'll add more: Access vulnerable web server → Send crafted request to endpoint → Parameter manipulation bypasses sanitization → SQL injection executes → Database compromise. I'll keep to 3-7 step chain using phases: Access → Delivery → Exploit → Impact. "Access unauthenticated endpoint → Deliver malicious SQL in HTTP parameter → Exploit SQL injection in query building → Execute unauthorized database operations → Exfiltrate or modify sensitive hotel data." That's 5 steps. I'll format with arrows. confidence_notes: NVD provided CVE but the description and CVSS vector came from VulDB (CNA). Exploit existence confirmed by public GitHub issues. No vendor confirmation, as vendor did not respond. The CPE is assigned, and the commit hash is given. The CVSS 4.0 vector is from VulDB. So: "Vulnerability confirmed by VulDB CNA and NVD. Exploit publicly available on GitHub. No vendor advisory or fix. Impact considered low by CVSS:4.0 but may be higher based on SQL injection nature." prevalence: What is deployment footprint? FantasticLBP Hotels Server is a niche open-source PHP hotel management system. I'd say it's rare. Prevalence: rare. Basis: "niche open-source hotel management system with limited deployment." So prevalence_basis: "niche open-source hotel management project." I'll set prevalence to "rare". assessed_cvss_vector: I'll produce my own CVSS 3.1 vector. AV:N (remote), AC:L (no complexity), PR:N (no authentication), UI:N, S:U (no scope change, only the database server), C:H (confidentiality high, as injection can leak all data), I:H (integrity high, can modify data), A:H (availability maybe by dropping tables? Usually SQLi can cause denial of service, but I'll set A:H because SQL injection can disrupt database, but careful: typical SQLi impact is C:H/I:H/A:N or A:H. I'll choose A:H for worst case, but often it's A:N unless the injection allows database shutdown. However, I'll be conservative: A:L or A:N? The description doesn't mention availability
Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.
SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
We need to construct the JSON as per the instructions, based on the provided CVE data. Let's analyze the inputs. CVE ID: CVE-2025-14711 Description: A flaw in FantasticLBP Hotels Server up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0. Unknown code in /controller/api/hotelList.php. Manipulation of argument pickedHotelName/type causes SQL injection. Attack can be carried out remotely. Exploit published. Rolling release. Vendor did not respond. CVSS Score: 5.5 (but there's a CVSS 4.0 vector provided: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... rest with X). The CVSS 4.0 base is AV:N, etc. Score 5.5 would correspond to a CVSS 3.1? But they gave CVSS:4.0 vector. Possibly they just gave a CVSS 4.0 base score of 5.5? Actually they wrote "CVSS Score: 5.5" then CVSS Vector with CVSS:4.0. That seems inconsistent. Possibly the score is from a different version. The provided vector is CVSS 4.0, and it's AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That sounds like low impact to confidentiality integrity availability. That might yield a low score. I'll trust the vector, and the score is not crucial as we are to do our own assessed CVSS vectors. I'll ignore the 5.5 score and rely on the provided CVSS 4.0 vector info. Actually the description says "SQL injection". Typically SQLi can lead to high impact (reading data, modifying). But the provided vector indicates low impact on each. That might be a conservative assessment. My own assessment: SQL injection in a hotel management system could lead to reading sensitive data (C high), maybe modifying (I high), but depending on database permissions. I need to assess based on the description. The description says "manipulation ... causes sql injection". No specifics on impact, but typical SQLi can be severe. I'll set C/I/A accordingly. Usually for SQLi, I assume confidentiality impact high (read data), integrity maybe high if writeable, availability maybe low. But I can choose. Since it's an API endpoint that might return hotel list, maybe it's select query? But parameter pickedHotelName/type might be used in a query, injection might allow arbitrary read. I'll assess with CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H? Possibly. But need to be realistic: without authentication, remote SQLi, full DB compromise likely. I'll set C:H/I:H/A:H. For CVSS 4.0, I can map similarly: VC:H/VI:H/VA:H? But the provided vector had L. I'll use my own assessment. I'll include rationale. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). SQL injection falls under CWE-89, but they gave CWE-74, a broader class. Probably it's SQLi. I'll mention SQL injection. Multi-source intelligence: - EPSS: 0.08% (percentile 23%) - low likelihood of exploitation soon. - POC/Exploit: Publicly available (yes, the description says exploit published, and references point to GitHub issues). - Reported by cna@vuldb.com. - CPE: cpe:2.3:a:fantasticlbp:hotels_server:*:*:*:*:*:*:*:* (up to that commit). - Tags: PHP, SQLi, Hotels Server. - References: two exploit links to github.com/navex2/CVE/issues/1 and /2, then vuldb entries. No KEV listed, so not in CISA Known Exploited Vulnerabilities. POC available but not confirmed active exploitation. EPSS low. Patch status: The description says "The product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way." So no patch mentioned. Input has no explicit patch version or advisory. So I'll state "No vendor-released patch identified at time of analysis." But there might be a fix around that commit? The version is "up to 67b44df162fab26df209bd5d5d542875fcbec1d0", which looks like a commit hash. So all versions before that commit might be vulnerable. Rolling release might mean there's no versioned release, just commits. The fix might be in a later commit, but we don't know. So patch unavailable. Product: FantasticLBP Hotels Server. The product_name: "Hotels Server" or "FantasticLBP Hotels Server"? The CPE says fantasticlbp:hotels_server. I'll use "FantasticLBP Hotels Server" as product name (1-3 words: "FantasticLBP Hotels Server"? That's three words. Or "Hotels Server"? I'll use "FantasticLBP Hotels Server" as precise name. It's a PHP web application for hotel management. Now craft each field: product_name: "FantasticLBP Hotels Server" (three words, but "Hotels Server" might be better? The CPE product is hotels_server, vendor fantasticlbp. So product name: "Hotels Server". However, description says "FantasticLBP Hotels Server". I'll use "HotelServer" or "Hotels Server"? The tag says "PHP, SQLi, Hotels Server". I'll go with "Hotels Server" but need to ensure it's specific. The full name is "FantasticLBP Hotels Server". I'll use "FantasticLBP Hotels Server" (3 words). Good. summary: Start with specific impact verb and product. "SQL injection in FantasticLBP Hotels Server up to commit 67b44df... allows remote unauthenticated attackers to manipulate database queries via the pickedHotelName or type parameters in /controller/api/hotelList.php." Then mention active exploitation? Not active, but POC available. EPSS low. So: "Publicly available exploit code exists, though EPSS indicates a low exploitation probability. The vendor has not responded to disclosure and no fix is available." That fits. It's original synthesis. technical_context: Underlying technology: PHP web application for hotel management. The vulnerable component is the /controller/api/hotelList.php API endpoint that handles hotel listing requests. The parameters pickedHotelName and type are likely used directly in a SQL query without proper sanitization, leading to SQL injection (CWE-89, but classified under CWE-74 broader injection). CPE confirms affected product is cpe:2.3:a:fantasticlbp:hotels_server:* up to the specified commit. This is a PHP/SQL context. risk_assessment: CVSS vector provided is CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/E:P, indicating network-accessible, no privileges required, no user interaction, but only low impact on confidentiality, integrity, availability. However, typical SQLi can be high impact. EPSS 0.08% (23rd percentile) indicates low expected exploitation activity. POC publicly available but not listed in KEV, so no known active exploitation. SSVC assessment: no active exploitation, automatable (yes, remote SQLi), technical impact potentially high (depending on DB permissions). The low EPSS and lack of KEV suggest this is not an immediate priority compared to higher-risk vulnerabilities, but the POC availability and unauthenticated nature warrant attention for exposed instances. Note that the CVSS impact rating may understate the true impact if the database is not isolated. Contrast signals: EPSS low, POC published, no KEV, unauthenticated network vector, low impact per provided CVSS but SQLi often leads to data breach. I'll state: "CVSS:4.0 vector rates impact as low, but SQL injection in a hotel management system could expose guest data, making potential real-world impact higher. EPSS score is low despite public POC, suggesting limited exploitation activity at this time." affected_products: FantasticLBP Hotels Server, all versions up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0 (rolling release, no fixed version). The CPE is cpe:2.3:a:fantasticlbp:hotels_server:*:*:*:*:*:*:*:*. No vendor advisory; references include VulDB entries and exploit GitHub issues. So: "Affects FantasticLBP Hotels Server up to and including commit 67b44df162fab26df209bd5d5d542875fcbec1d0; no official release version identifier. The product uses a rolling release model. Refer to the VulDB advisory (336428) and exploit proofs at GitHub issues #1 and #2 in the navex2/CVE repository." I'll write concisely. remediation: No vendor patch available; vendor did not respond. Suggest: "Upgrade to a later commit if one exists that fixes the SQL injection, though no fixed version is announced. As a workaround, implement input validation and parameterized queries on the affected endpoint. Consider restricting access to /controller/api/hotelList.php via web server rules until the code is fixed. Disabling the endpoint if not essential can mitigate the risk. Also, ensure the database account used by the application has minimal privileges to limit potential impact." I'll phrase naturally. exploit_scenario: An attacker sends a crafted HTTP request to /controller/api/hotelList.php with malicious SQL in the pickedHotelName or type parameter. This injects SQL commands, potentially allowing data exfiltration (e.g., guest records) or database modification. A proof of concept is publicly available on GitHub. exploitation_conditions: No complex conditions. Remote unauthenticated attack against the API endpoint is sufficient. No special configuration or authentication required. The endpoint appears to be part of the application's default functionality. There are no limiting factors beyond the accessibility of the web server. So: "No special conditions — remote unauthenticated exploitation against default installations of FantasticLBP Hotels Server with the /controller/api/hotelList.php endpoint exposed." Actually we need EXACT product feature, protocol, configuration: "The vulnerability exists in the hotelList.php API endpoint, which is accessible over HTTP(S) without authentication. No specific configuration is required; the endpoint is present in default deployments." attack_chain: "Send HTTP request to /controller/api/hotelList.php with crafted 'pickedHotelName' parameter → Inject SQL payload into database query → Execute arbitrary SQL queries → Read or modify hotel data." That's 4 steps. I'll add more: Access vulnerable web server → Send crafted request to endpoint → Parameter manipulation bypasses sanitization → SQL injection executes → Database compromise. I'll keep to 3-7 step chain using phases: Access → Delivery → Exploit → Impact. "Access unauthenticated endpoint → Deliver malicious SQL in HTTP parameter → Exploit SQL injection in query building → Execute unauthorized database operations → Exfiltrate or modify sensitive hotel data." That's 5 steps. I'll format with arrows. confidence_notes: NVD provided CVE but the description and CVSS vector came from VulDB (CNA). Exploit existence confirmed by public GitHub issues. No vendor confirmation, as vendor did not respond. The CPE is assigned, and the commit hash is given. The CVSS 4.0 vector is from VulDB. So: "Vulnerability confirmed by VulDB CNA and NVD. Exploit publicly available on GitHub. No vendor advisory or fix. Impact considered low by CVSS:4.0 but may be higher based on SQL injection nature." prevalence: What is deployment footprint? FantasticLBP Hotels Server is a niche open-source PHP hotel management system. I'd say it's rare. Prevalence: rare. Basis: "niche open-source hotel management system with limited deployment." So prevalence_basis: "niche open-source hotel management project." I'll set prevalence to "rare". assessed_cvss_vector: I'll produce my own CVSS 3.1 vector. AV:N (remote), AC:L (no complexity), PR:N (no authentication), UI:N, S:U (no scope change, only the database server), C:H (confidentiality high, as injection can leak all data), I:H (integrity high, can modify data), A:H (availability maybe by dropping tables? Usually SQLi can cause denial of service, but I'll set A:H because SQL injection can disrupt database, but careful: typical SQLi impact is C:H/I:H/A:N or A:H. I'll choose A:H for worst case, but often it's A:N unless the injection allows database shutdown. However, I'll be conservative: A:L or A:N? The description doesn't mention availability
Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.