CVE-2025-11405
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in SourceCodester Hotel and Lodge Management System 1.0 in /del_tax.php allows manipulation of the ID argument leading to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.
Risk Assessment
An attacker could gain unauthorized access to the database, potentially leading to data disclosure, modification, or deletion, and possibly system compromise.
Recommendation
Update the system to the latest version and use parameterized queries or prepared statements to prevent SQL injection.
Other vulnerabilities in SourceCodester Hotel and Lodge Management System
See all- CVE-2025-11470Medium
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to version 1.0. The impacted element is an unknown function of the file /manage_website.php, where manipulation of the website_image/back_login_image arguments leads to unrestricted upload. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2025-11469Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in /pages/save_customer.php. Manipulation of the Contact argument allows remote attack. The exploit is publicly available.
- CVE-2025-11404Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_tax.php. Manipulation of the percentage argument allows remote attack execution. The exploit has been publicly disclosed and may be used.
- CVE-2025-11403Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /del_booking.php. Manipulation of the ID argument allows remote attack execution. The exploit has been made public and could be used.
- CVE-2025-11402Medium
A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /del_curr.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2025-11401Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_curr.php. Manipulation of the currcode argument causes SQL injection. The attack can be carried out remotely. The exploit has been published and may be used.
- CVE-2025-11400Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /del_room.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely. The exploit is now public and may be used.
- CVE-2025-11399Medium
A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_room.php. Manipulation of the floorno argument leads to SQL injection. Remote exploitation is possible. The exploit has been disclosed publicly and may be used.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Hotel and Lodge Management System 1.0. This vulnerability affects unknown code of the file /del_tax.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS