CVE-2025-10788
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks on SourceCodester Online Hotel Reservation System 1.0 via the deleteroominventory.php file. Attackers can manipulate the ID parameter to potentially access, modify, or delete database content. Any organization using this specific hotel reservation system version is affected.
💻 Affected Systems
- SourceCodester Online Hotel Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of sensitive guest information (personal data, payment details), reservation manipulation, system takeover, and potential lateral movement to other systems.
Likely Case
Unauthorized data access and modification of hotel reservation records, potential data exfiltration, and system disruption.
If Mitigated
Limited impact with proper input validation, database permissions, and network segmentation in place.
🎯 Exploit Status
Public exploit details available on GitHub. SQL injection typically requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider: 1. Check vendor website for updates 2. Implement parameterized queries in deleteroominventory.php 3. Add input validation for ID parameter 4. Apply web application firewall rules
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting deleteroominventory.php
# Example ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
Input Validation Filter
linuxAdd PHP input validation to only accept numeric values for ID parameter
<?php
if (!is_numeric($_GET['id'])) {
http_response_code(400);
exit('Invalid ID');
}
?>
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to restrict database access from web server
🔍 How to Verify
Check if Vulnerable:
Test by sending SQL injection payloads to deleteroominventory.php?id parameter (e.g., id=1' OR '1'='1). Monitor for database errors or unexpected responses.Check Version:
Check PHP files for version comments or examine system documentation. Typically found in readme files or configuration files.Verify Fix Applied:
Attempt SQL injection tests after implementing fixes. Verify no database errors are returned and input validation rejects malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed requests to deleteroominventory.php
- SQL syntax errors in web server logs
- Unusual database access patterns
Network Indicators:
- HTTP requests with SQL keywords in URL parameters
- Repeated requests to deleteroominventory.php with varying ID parameters
- Outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="*deleteroominventory.php*" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR*1*" OR query="*--*" OR query="*;*" OR query="*'*'*'")🔗 References
- https://github.com/peri0d/my_cve/blob/main/Online-Hotel-Reservation-System-In-PHP-With-Source-Code-deleteroominventory.php-sql-injection.md
- https://vuldb.com/?ctiid.325145
- https://vuldb.com/?id.325145
- https://vuldb.com/?submit.653877
- https://www.sourcecodester.com/
- https://github.com/peri0d/my_cve/blob/main/Online-Hotel-Reservation-System-In-PHP-With-Source-Code-deleteroominventory.php-sql-injection.md
