CVE-2025-10621

Vulnerability

Overview

A SQL injection vulnerability exists in the editroomimage.php file of SourceCodester Hotel Reservation System 1.0. The root cause is insufficient validation of the id parameter, which is directly concatenated into SQL queries without sanitization. This allows an attacker to inject malicious SQL code through the id parameter [1].

Exploitation

The attack can be performed remotely without requiring authentication. An attacker simply sends a crafted HTTP request to the vulnerable endpoint, manipulating the id parameter to inject SQL commands. The vulnerability supports time-based blind, boolean-based blind, and UNION query techniques, making it exploitable even without direct output [1].

Impact

Successful exploitation grants an attacker unauthorized access to the database, enabling sensitive data leakage, data tampering, and potentially full system control. The impact extends to compromising business continuity and data integrity [1].

Mitigation

As of the publication date, no official patch has been released. The vendor should implement proper input validation and parameterized queries to prevent SQL injection. Users are advised to apply input sanitization or restrict access to the affected file until a fix is available [1].