SQL Injection Vulnerability in Hotel/admin/roombook.php
CVE-2024-25315

9.8CRITICAL

Key Information:

Vendor
Code-projects
Status
Hotel Management System
Vendor
CVE Published:
9 February 2024

Summary

The Hotel Management System version 1.0 developed by Code-projects contains a vulnerability that enables SQL Injection through the 'rid' parameter in the script located at Hotel/admin/roombook.php. This vulnerability could be exploited by attackers to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive information stored in the database. Proper input validation and parameterized queries are necessary to mitigate the risk associated with this vulnerability.

References

https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managm...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-25315 : SQL Injection Vulnerability in Hotel/admin/roombook.php | SecurityVulnerability.io