CVE-2025-11469
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in /pages/save_customer.php. Manipulation of the Contact argument allows remote attack. The exploit is publicly available.
Risk Assessment
An attacker can remotely inject SQL code, potentially leading to data confidentiality and integrity breaches. Public exploit increases risk.
Recommendation
Apply patches or restrict access to /pages/save_customer.php. Use parameterized queries.
Other vulnerabilities in SourceCodester Hotel and Lodge Management System
See all- CVE-2025-11470Medium
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to version 1.0. The impacted element is an unknown function of the file /manage_website.php, where manipulation of the website_image/back_login_image arguments leads to unrestricted upload. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2025-11405Medium
A vulnerability in SourceCodester Hotel and Lodge Management System 1.0 in /del_tax.php allows manipulation of the ID argument leading to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2025-11404Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_tax.php. Manipulation of the percentage argument allows remote attack execution. The exploit has been publicly disclosed and may be used.
- CVE-2025-11403Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /del_booking.php. Manipulation of the ID argument allows remote attack execution. The exploit has been made public and could be used.
- CVE-2025-11402Medium
A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /del_curr.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2025-11401Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_curr.php. Manipulation of the currcode argument causes SQL injection. The attack can be carried out remotely. The exploit has been published and may be used.
- CVE-2025-11400Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /del_room.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely. The exploit is now public and may be used.
- CVE-2025-11399Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_room.php. Manipulation of the floorno argument leads to SQL injection. Remote exploitation is possible. The exploit has been disclosed publicly and may be used.
Original NVD description (English source)
A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /pages/save_customer.php. Executing manipulation of the argument Contact can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS