CVE-2025-6450

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/confirm_reserve.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Online Hotel Reservation System	1.0

References

https://code-projects.org/Product
https://github.com/zzb1388/cve/issues/10Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.313557Permissions Required, VDB Entry
https://vuldb.com/?id.313557Third Party Advisory, VDB Entry
https://vuldb.com/?submit.598588Third Party Advisory, VDB Entry
https://github.com/zzb1388/cve/issues/10Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-645007.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines CVE-2025-645017.6ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirro CVE-2025-645026.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provi CVE-2025-645033.3cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other tha CVE-2025-645045.0Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1, CVE-2025-645056.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. CVE-2025-645066.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. CVE-2025-645077.8Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environ CVE-2025-645087.5Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zer CVE-2025-645097.5Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink t CVE-2025-64519.8A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability CVE-2025-645118.8MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databas