CVE-2025-12594

MEDIUM

Simple Online Hotel Reservation System 2.0 - SQL Injection

Title source: llm
STIX 2.1

Description

A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the file /admin/add_account.php. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.330889
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.330889
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.677576
Product product
https://code-projects.org/

Scores

CVSS v3 4.7
EPSS 0.0001
EPSS Percentile 0.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
fabian/simple_online_hotel_reservation_system 2.0
Published Nov 02, 2025
Tracked Since Feb 18, 2026