CVE-2025-0340
📋 TL;DR
This critical SQL injection vulnerability in Cinema Seat Reservation System 1.0 allows attackers to execute arbitrary SQL commands via the 'id' parameter in /admin/deleteBooking.php. Attackers can potentially access, modify, or delete database content including user credentials and booking data. All installations of version 1.0 with the vulnerable file accessible are affected.
💻 Affected Systems
- Cinema Seat Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to booking data, user information, and potential administrative credential theft.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
Exploit has been publicly disclosed. SQL injection via 'id' parameter is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries in /admin/deleteBooking.php or apply workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation to ensure 'id' parameter contains only numeric values
In deleteBooking.php, add: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting /admin/deleteBooking.php
WAF rule: Block requests to /admin/deleteBooking.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Restrict access to /admin/ directory via .htaccess or web server configuration
- Implement network segmentation to isolate the application from sensitive databases
🔍 How to Verify
Check if Vulnerable:
Test /admin/deleteBooking.php?id=1' OR '1'='1 and check for SQL errors or unexpected behaviorCheck Version:
Check system documentation or version file if presentVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Multiple failed requests to /admin/deleteBooking.php with SQL keywords
Network Indicators:
- HTTP requests to /admin/deleteBooking.php with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND uri="/admin/deleteBooking.php" AND (param="id" AND value MATCHES "(?i)(union|select|insert|delete|update|drop|--|'|;)")