CVE-2025-11470
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to version 1.0. The impacted element is an unknown function of the file /manage_website.php, where manipulation of the website_image/back_login_image arguments leads to unrestricted upload. The attack can be carried out remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely upload malicious files to the server, potentially leading to code execution, system compromise, or data theft. The risk is high because the exploit is publicly available.
Recommendation
Immediately update the system to the latest version or apply vendor patches. If updating is not possible, restrict access to /manage_website.php and implement file upload validation.
Other vulnerabilities in SourceCodester Hotel and Lodge Management System
See all- CVE-2025-11469Medium
A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in /pages/save_customer.php. Manipulation of the Contact argument allows remote attack. The exploit is publicly available.
- CVE-2025-11402Medium
A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /del_curr.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the file /manage_website.php. The manipulation of the argument website_image/back_login_image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS