CVE-2025-0230 in Responsive Hotel Site
Summary
by MITRE • 01/05/2025
A vulnerability, which was classified as critical, was found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file /admin/print.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/11/2025
This critical sql injection vulnerability exists in the code-projects Responsive Hotel Site 1.0 application within the administrative print functionality. The flaw resides in the /admin/print.php file where an unvalidated parameter pid is directly incorporated into sql query construction without proper sanitization or parameterization. This represents a classic sql injection vector that allows malicious actors to manipulate database queries through crafted input. The vulnerability has been publicly disclosed and is actively exploitable, making it a significant risk to affected systems.
The technical implementation of this vulnerability stems from improper input validation and sanitization practices within the application's administrative interface. When the pid parameter is passed to the print.php script, it undergoes insufficient validation before being embedded into database queries. This allows attackers to inject malicious sql payloads that can manipulate the database structure, extract sensitive information, modify records, or even execute arbitrary commands depending on the underlying database system and permissions. The remote exploitation capability means that attackers do not require physical access to the system and can target the vulnerability over network connections.
The operational impact of this vulnerability extends beyond simple data theft or modification. Successful exploitation could lead to complete database compromise, allowing attackers to access customer information, reservation details, pricing data, and potentially administrative credentials. The remote nature of the attack means that organizations may not detect compromise until after significant damage has occurred. This vulnerability particularly affects hospitality management systems where sensitive personal and financial data is stored, creating potential for identity theft, fraud, and regulatory compliance violations. The disclosure of the exploit increases the likelihood of widespread exploitation across vulnerable installations.
Mitigation strategies should focus on immediate patching of the affected application to address the input validation flaw. Organizations must implement proper parameterized queries and input sanitization techniques to prevent sql injection attacks. The principle of least privilege should be enforced by limiting database permissions for the application user account and implementing proper access controls for administrative functions. Network segmentation and intrusion detection systems can help identify exploitation attempts, while regular security assessments should verify that similar vulnerabilities do not exist in other application components. This vulnerability aligns with CWE-89 sql injection and maps to attack techniques in the ATT&CK framework under T1190 for exploitation of remote services and T1071 for application layer protocols.