CVE-2025-10623

Overview

The SourceCodester Hotel Reservation System version 1.0 contains a SQL injection vulnerability in the deleteuser.php file [1]. The root cause is insufficient validation of the id parameter, which is directly concatenated into SQL queries without sanitization [1]. This bug allows an attacker to inject arbitrary SQL code through the id argument [1].

Exploitation

The vulnerability can be exploited remotely without any authentication or authorization [1]. The id parameter is the attack surface, and the vulnerability type is time-based blind SQL injection [1]. This means an attacker can send crafted payloads via HTTP requests to the deleteuser.php endpoint to extract information even without visible error output [1].

Impact

Successful exploitation grants an attacker unauthorized access to the underlying database [1]. Potential consequences include data leakage, modification or deletion of sensitive records, and, in worst cases, full system compromise or service interruption [1]. The vendor homepage is referenced as sourcecodester.com [2], but no patch has been publicly released.

Mitigation

As of the publication date (2025-09-17), no fix has been provided by the vendor [1]. Users of the affected product should treat the system as compromised, apply input sanitization to the id parameter, and consider isolating the application until a patch is available.