CVE-2025-12855
📋 TL;DR
CVE-2025-12855 is an SQL injection vulnerability in Responsive Hotel Site 1.0's newsletterdel.php admin file. Attackers can manipulate the 'eid' parameter to execute arbitrary SQL commands remotely. This affects all installations of Responsive Hotel Site 1.0 with the vulnerable file accessible.
💻 Affected Systems
- Responsive Hotel Site
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized database access allowing extraction of sensitive information like user credentials, personal data, or administrative access.
If Mitigated
Limited impact if proper input validation and WAF rules block malicious SQL payloads.
🎯 Exploit Status
Exploit requires admin access to reach the vulnerable endpoint. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or input validation to newsletterdel.php to sanitize the 'eid' parameter.
Edit /admin/newsletterdel.php to use prepared statements with PDO or mysqli.
Access Restriction
linuxRestrict access to /admin/newsletterdel.php via .htaccess or web server configuration.
Order deny,allow
Deny from all
Allow from 127.0.0.1
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with SQL injection rules.
- Monitor and audit database queries for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check if /admin/newsletterdel.php exists and inspect the code for unsanitized 'eid' parameter usage.Check Version:
Check the software version in the admin panel or configuration files.Verify Fix Applied:
Test the endpoint with SQL injection payloads to ensure they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
Network Indicators:
- HTTP requests to /admin/newsletterdel.php with SQL payloads in parameters
SIEM Query:
source="web_logs" AND uri="/admin/newsletterdel.php" AND (param="eid" AND value MATCHES "' OR '1'='1")🔗 References
- https://code-projects.org/
- https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/newsletterdel-sql-injection/report.md
- https://vuldb.com/?ctiid.331501
- https://vuldb.com/?id.331501
- https://vuldb.com/?submit.679743
- https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/newsletterdel-sql-injection/report.md
