{"id":"CVE-2025-11479","state":"PUBLISHED","title":"SourceCodester Wedding Reservation Management System function.php insertReservation sql injection","description":"A security vulnerability has been detected in SourceCodester Wedding Reservation Management System 1.0. Impacted is the function insertReservation of the file function.php. Such manipulation of the argument number leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.","publishedAt":"2025-10-08T14:32:06.086Z","updatedAt":"2025-10-08T15:55:25.093Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Wedding Reservation Management System"],"affected":[{"vendor":"SourceCodester","product":"Wedding Reservation Management System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://vuldb.com/?id.327597","https://vuldb.com/?ctiid.327597","https://vuldb.com/?submit.667388","https://github.com/DrNbnonono/CVE/issues/7","https://www.sourcecodester.com/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/11xxx/CVE-2025-11479.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-11479","state":"PUBLISHED","datePublished":"2025-10-08T14:32:06.086Z","dateUpdated":"2025-10-08T15:55:25.093Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-10-08T05:04:53.489Z"},"containers":{"cna":{"title":"SourceCodester Wedding Reservation Management System function.php insertReservation sql injection","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in SourceCodester Wedding Reservation Management System 1.0. Impacted is the function insertReservation of the file function.php. Such manipulation of the argument number leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used."},{"lang":"de","value":"Es wurde eine Schwachstelle in SourceCodester Wedding Reservation Management System 1.0 entdeckt. Betroffen ist die Funktion insertReservation der Datei function.php. Die Manipulation des Arguments number führt zu sql injection. Ein Angriff ist aus der Distanz möglich. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden."}],"affected":[{"vendor":"SourceCodester","product":"Wedding Reservation Management System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.327597","name":"VDB-327597 | SourceCodester Wedding Reservation Management System function.php insertReservation sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.327597","name":"VDB-327597 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.667388","name":"Submit #667388 | SourceCodester Wedding Reservation Management System V1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/DrNbnonono/CVE/issues/7","tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-10-08T14:32:06.086Z"},"timeline":[{"time":"2025-10-08T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-10-08T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-10-08T07:09:57.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Drnbnonono (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-08T15:55:16.203692Z","id":"CVE-2025-11479","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-08T15:55:25.093Z"}}]}}}