PT-2025-41153 · Sourcecodester · Sourcecodester Hotel/Lodge Management System

Liuzhouyang · Published 2025-10-07 · Updated 2025-10-07 · CVE-2025-11404

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Hotel and Lodge Management System version 1.0

Description A flaw exists in SourceCodester Hotel and Lodge Management System 1.0, specifically within the /pages/save tax.php file. Manipulation of the percentage argument can result in a SQL injection. This issue is potentially exploitable remotely, and details about the exploit have been publicly disclosed.

Recommendations Apply any available updates or patches for SourceCodester Hotel and Lodge Management System version 1.0. As a temporary workaround, restrict access to the /pages/save tax.php file. Sanitize the percentage argument before using it in SQL queries.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-11404

Affected Products

Sourcecodester Hotel/Lodge Management System

References · 8

• 🔥 https://github.com/TThuyyy/cve1/issues/12 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11404 · Security Note
• https://vuldb.com/?ctiid.327341 · Note
• https://vuldb.com/?id.327341 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/?submit.665113 · Note
• https://twitter.com/CVEnew/status/1975634524500340895 · Twitter Post