CVE-2025-11401
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_curr.php. Manipulation of the currcode argument causes SQL injection. The attack can be carried out remotely. The exploit has been published and may be used.
Risk Assessment
An attacker can remotely manipulate the database, potentially leading to unauthorized data access or modification. The publicly available exploit increases the risk of exploitation.
Recommendation
Apply patches immediately or restrict access to the system. Validate input data and use parameterized queries.
Other vulnerabilities in SourceCodester Hotel and Lodge Management System
See all- CVE-2025-11470Medium
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to version 1.0. The impacted element is an unknown function of the file /manage_website.php, where manipulation of the website_image/back_login_image arguments leads to unrestricted upload. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2025-11469Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in /pages/save_customer.php. Manipulation of the Contact argument allows remote attack. The exploit is publicly available.
- CVE-2025-11405Medium
A vulnerability in SourceCodester Hotel and Lodge Management System 1.0 in /del_tax.php allows manipulation of the ID argument leading to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2025-11404Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_tax.php. Manipulation of the percentage argument allows remote attack execution. The exploit has been publicly disclosed and may be used.
- CVE-2025-11403Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /del_booking.php. Manipulation of the ID argument allows remote attack execution. The exploit has been made public and could be used.
- CVE-2025-11402Medium
A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /del_curr.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2025-11400Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /del_room.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely. The exploit is now public and may be used.
- CVE-2025-11399Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_room.php. Manipulation of the floorno argument leads to SQL injection. Remote exploitation is possible. The exploit has been disclosed publicly and may be used.
Original NVD description (English source)
A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /pages/save_curr.php. This manipulation of the argument currcode causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS