CVE-2025-1964
📋 TL;DR
This critical SQL injection vulnerability in Online Hotel Booking 1.0 allows remote attackers to execute arbitrary SQL commands via the 'checkin' parameter in the /booknow.php endpoint. Attackers can potentially access, modify, or delete database content, including sensitive guest information. All systems running the vulnerable software are affected.
💻 Affected Systems
- projectworlds Online Hotel Booking
📦 What is this software?
Online Hotel Booking by Projectworlds
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to sensitive guest data (personal information, payment details), database manipulation, or denial of service
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place
🎯 Exploit Status
Exploit code is publicly available on GitHub, making attacks easy for even low-skilled attackers
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Implement workarounds or consider replacing the software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for all user inputs
Modify booknow.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM bookings WHERE checkin = ?'); $stmt->bind_param('s', $checkin);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:checkin "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the vulnerable system behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test the /booknow.php?roomname=Duplex&checkin= parameter with SQL injection payloads like ' OR '1'='1Check Version:
Check PHP files for version comments or review software documentationVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Suspicious patterns in checkin parameter values
Network Indicators:
- HTTP requests with SQL keywords in parameters
- Unusual traffic to /booknow.php endpoint
SIEM Query:
source="web_logs" AND uri="/booknow.php" AND (param="checkin" AND value MATCHES "(?i)(union|select|insert|delete|update|drop|--|' OR)")