{"id":"CVE-2025-10788","state":"PUBLISHED","title":"SourceCodester Online Hotel Reservation System deleteroominventory.php sql injection","description":"A vulnerability was determined in SourceCodester Online Hotel Reservation System 1.0. The affected element is an unknown function of the file deleteroominventory.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.","publishedAt":"2025-09-22T07:32:09.782Z","updatedAt":"2025-09-22T15:50:30.704Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Online Hotel Reservation System"],"affected":[{"vendor":"SourceCodester","product":"Online Hotel Reservation System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://vuldb.com/?id.325145","https://vuldb.com/?ctiid.325145","https://vuldb.com/?submit.653877","https://github.com/peri0d/my_cve/blob/main/Online-Hotel-Reservation-System-In-PHP-With-Source-Code-deleteroominventory.php-sql-injection.md","https://www.sourcecodester.com/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10788.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-10788","state":"PUBLISHED","datePublished":"2025-09-22T07:32:09.782Z","dateUpdated":"2025-09-22T15:50:30.704Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-09-21T09:16:02.451Z"},"containers":{"cna":{"title":"SourceCodester Online Hotel Reservation System deleteroominventory.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Online Hotel Reservation System 1.0. The affected element is an unknown function of the file deleteroominventory.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized."},{"lang":"de","value":"Es wurde eine Schwachstelle in SourceCodester Online Hotel Reservation System 1.0 entdeckt. Es geht hierbei um eine nicht näher spezifizierte Funktion der Datei deleteroominventory.php. Durch das Beeinflussen des Arguments ID mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"SourceCodester","product":"Online Hotel Reservation System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.325145","name":"VDB-325145 | SourceCodester Online Hotel Reservation System deleteroominventory.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.325145","name":"VDB-325145 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.653877","name":"Submit #653877 | SourceCodester Online Hotel Reservation System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/peri0d/my_cve/blob/main/Online-Hotel-Reservation-System-In-PHP-With-Source-Code-deleteroominventory.php-sql-injection.md","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-09-22T07:32:09.782Z"},"timeline":[{"time":"2025-09-21T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-09-21T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-09-21T11:21:10.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Chenguang Wang-GuangZhou University (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/peri0d/my_cve/blob/main/Online-Hotel-Reservation-System-In-PHP-With-Source-Code-deleteroominventory.php-sql-injection.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-22T15:50:22.900844Z","id":"CVE-2025-10788","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-22T15:50:30.704Z"}}]}}}