CVE-2025-11402
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary SQL commands via the ID parameter in the /del_curr.php file of SourceCodester Hotel and Lodge Management System 1.0, potentially leading to data theft, manipulation, or system compromise. It affects all users running the vulnerable version of this software, particularly those with internet-facing deployments.
💻 Affected Systems
- SourceCodester Hotel and Lodge Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise, including unauthorized access, data deletion, or remote code execution if database privileges allow.
Likely Case
Data exfiltration or manipulation of hotel/lodge management data, such as guest records or booking information.
If Mitigated
Limited impact if input validation or WAF blocks malicious SQL payloads, but risk remains if not patched.
🎯 Exploit Status
Exploit details are publicly disclosed, making it easy for attackers to craft SQL injection payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified by vendor
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
Check the vendor website for updates or patches; if unavailable, apply workarounds or consider alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to sanitize the ID parameter in /del_curr.php, rejecting malicious SQL characters.
Modify PHP code to use prepared statements or parameterized queries for database interactions.
Web Application Firewall (WAF) Rules
allDeploy a WAF to block SQL injection attempts targeting the /del_curr.php endpoint.
Configure WAF rules to detect and block patterns like ' OR '1'='1' or UNION SELECT in requests.
🧯 If You Can't Patch
- Restrict network access to the system, allowing only trusted IPs to reduce exposure.
- Monitor logs for unusual SQL queries or access attempts to /del_curr.php and implement intrusion detection.
🔍 How to Verify
Check if Vulnerable:
Test the /del_curr.php endpoint with a SQL injection payload (e.g., ID=1' OR '1'='1) and check for database errors or unexpected responses.Check Version:
Check the software version in the admin panel or configuration files; default is 1.0.Verify Fix Applied:
After applying fixes, retest with the same payload; successful fixes should return an error message or no data leakage.📡 Detection & Monitoring
Log Indicators:
- Log entries showing SQL syntax errors or unusual database queries from /del_curr.php requests.
Network Indicators:
- HTTP requests to /del_curr.php with SQL keywords (e.g., UNION, SELECT, OR) in parameters.
SIEM Query:
source="/var/log/apache2/access.log" AND uri="/del_curr.php" AND (param="ID" AND value MATCHES "'.*OR.*'" OR value MATCHES ".*UNION.*SELECT.*")