PT-2025-41160 · Sourcecodester · Sourcecodester Hotel/Lodge Management System

Fuyang · Published 2025-10-07 · Updated 2025-10-07 · CVE-2025-11405

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Hotel and Lodge Management System version 1.0

Description A flaw exists in SourceCodester Hotel and Lodge Management System 1.0 related to the file /del tax.php. Manipulation of the ID parameter can lead to SQL injection. This issue can be exploited remotely. The exploit is publicly available.

Recommendations Apply any available updates or patches for SourceCodester Hotel and Lodge Management System version 1.0. As a temporary workaround, restrict access to the /del tax.php file. Sanitize the ID parameter before using it in SQL queries.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-11405

Affected Products

Sourcecodester Hotel/Lodge Management System

References · 8

• 🔥 https://github.com/bdrfly/cve/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11405 · Security Note
• https://vuldb.com/?ctiid.327342 · Note
• https://vuldb.com/?submit.665117 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/?id.327342 · Note
• https://twitter.com/CVEnew/status/1975646580872028630 · Twitter Post