CVE-2025-10623
SourceCodester Hotel Reservation System deleteuser.php sql injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 17, 2025
- Updated
- Sep 18, 2025
- Reserved
- Sep 17, 2025
Description
A vulnerability was identified in SourceCodester Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteuser.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Hotel Reservation SystemSourceCodester |
|
References
- VDB-324651 | SourceCodester Hotel Reservation System deleteuser.php sql injectionvdb-entrytechnical-description
- VDB-324651 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #650221 | SourceCodester Hotel Reservation System 1.0 SQL Injectionthird-party-advisory
- https://github.com/aCas1o/cve_report02/blob/main/report.mdexploit
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.