CVE-2025-9790

Vulnerability

Overview

CVE-2025-9790 describes a SQL injection vulnerability in SourceCodester Hotel Reservation System 1.0, specifically in the /admin/updateabout.php endpoint [1]. The root cause is that the address POST parameter is directly interpolated into SQL queries without any sanitization or use of prepared statements [1]. This allows an attacker to inject arbitrary SQL commands by manipulating the address value.

Exploitation

Details

The attack can be launched remotely without authentication [1]. The parameter is sent via POST to /newhotel/admin/updateabout.php. A public proof of concept using sqlmap demonstrates that the vulnerability is a time-based blind SQL injection, allowing automated exploitation [1]. No special network position is required beyond the ability to send HTTP requests to the affected endpoint.

Impact

Successful exploitation gives an attacker unauthorized access to the backend database [1]. This can lead to sensitive data leakage (e.g., user credentials, personal information), data tampering, privilege escalation, and potentially full control over the application environment [1]. The vendor's site [2] provides the software, but no official patch or advisory for this version has been released.

Mitigation

At the time of publication, no fix has been released by SourceCodester for version 1.0 [2]. Users should apply input validation and parameterized queries to the address parameter in /admin/updateabout.php, or consider discontinuing use of the vulnerable component until a patch is available [1]. Because a public exploit exists, immediate action is recommended.