PT-2025-41136 · Sourcecodester · Hotel/Lodge Management System

Liuzhouyang · Published 2025-10-07 · Updated 2025-10-07 · CVE-2025-11401

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Hotel and Lodge Management System version 1.0

Description A flaw exists in SourceCodester Hotel and Lodge Management System 1.0. The issue involves SQL injection, potentially exploitable remotely, stemming from manipulation of the currcode argument within an unknown function of the /pages/save curr.php file. The exploit for this issue has been published.

Recommendations Apply a fix for the SQL injection issue in the /pages/save curr.php file. Restrict access to the /pages/save curr.php file until a fix is available. Sanitize the currcode input to prevent SQL injection attacks.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-11401

Affected Products

Hotel/Lodge Management System

References · 10

• 🔥 https://github.com/TThuyyy/cve1/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11401 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11401 · Vendor Advisory
• https://vuldb.com/?ctiid.327338 · Note
• https://vuldb.com/?submit.665094 · Note
• https://sourcecodester.com · Note
• https://twitter.com/CVEnew/status/1975615144978682265 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1975665291964129418 · Twitter Post
• https://t.me/CVEtracker/34339 · Telegram Post
• https://vuldb.com/?id.327338 · Note