CVE-2025-14711
📋 TL;DR
This SQL injection vulnerability in FantasticLBP Hotels Server allows remote attackers to execute arbitrary SQL commands via the pickedHotelName/type parameters in hotelList.php. This affects all deployments running versions up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0. Attackers could potentially access, modify, or delete hotel reservation data.
💻 Affected Systems
- FantasticLBP Hotels Server
📦 What is this software?
Hotels Server by Fantasticlbp
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to hotel reservation data, guest information exposure, and potential data manipulation
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place
🎯 Exploit Status
Exploit details published on GitHub, remote exploitation possible without authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting hotelList.php parameters
Input Validation Filter
allAdd input validation for pickedHotelName and type parameters before processing
🧯 If You Can't Patch
- Isolate the server behind a reverse proxy with strict input validation
- Implement network segmentation to restrict access to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if your FantasticLBP Hotels Server version is at or before commit 67b44df162fab26df209bd5d5d542875fcbec1d0Check Version:
Check git commit hash or version file in installation directoryVerify Fix Applied:
Test the hotelList.php endpoint with SQL injection payloads to confirm they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed parameter validation attempts
- Suspicious patterns in pickedHotelName/type parameters
Network Indicators:
- SQL injection payloads in HTTP requests to /controller/api/hotelList.php
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/controller/api/hotelList.php" AND (param="pickedHotelName" OR param="type") AND (payload="' OR " OR "--" OR "UNION" OR "SELECT")