CVE-2025-1965: Online Hotel Booking SQLi Vulnerability

CVE-2025-1965 Overview

A critical SQL injection vulnerability has been identified in Projectworlds Online Hotel Booking version 1.0. The vulnerability exists in the /admin/login.php file, where the emailusername parameter is improperly sanitized before being used in SQL queries. This flaw allows unauthenticated remote attackers to inject malicious SQL statements, potentially compromising the entire database and enabling unauthorized access to the administrative interface.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to bypass authentication, extract sensitive data from the database, modify records, or potentially gain complete control of the hotel booking system without requiring any credentials.

Affected Products

• Projectworlds Online Hotel Booking 1.0

Discovery Timeline

• 2025-03-05 - CVE-2025-1965 published to NVD
• 2025-04-02 - Last updated in NVD database

Technical Details for CVE-2025-1965

Vulnerability Analysis

This vulnerability is classified as SQL Injection (CWE-89) and more broadly as an Injection vulnerability (CWE-74). The flaw resides in the administrative login functionality of the Online Hotel Booking application. When processing authentication requests, the application fails to properly sanitize or parameterize user-supplied input in the emailusername field before incorporating it into SQL queries.

The exploit has been publicly disclosed, meaning attackers have access to detailed exploitation techniques. This significantly increases the risk to organizations running unpatched instances of this software. The attack can be executed remotely over the network without requiring any authentication or user interaction, making it particularly dangerous for internet-facing deployments.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and parameterized queries in the /admin/login.php file. The application directly concatenates user-supplied data from the emailusername parameter into SQL statements without sanitization. This classic SQL injection pattern allows attackers to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious HTTP request to the /admin/login.php endpoint with SQL injection payloads embedded in the emailusername parameter. This allows the attacker to:

1. Bypass authentication by manipulating the login query to always return true
2. Extract sensitive information from the database through UNION-based or error-based injection techniques
3. Modify or delete database records
4. Potentially execute operating system commands if database permissions allow

The vulnerability can be exploited remotely by sending specially crafted POST requests to the admin login page, manipulating the emailusername field with SQL injection payloads such as authentication bypass strings or data extraction queries. For detailed technical information, refer to the GitHub security issue and VulDB entry.

Detection Methods for CVE-2025-1965

Indicators of Compromise

• HTTP requests to /admin/login.php containing SQL injection patterns in POST data (e.g., single quotes, UNION SELECT, OR 1=1)
• Unusual database error messages in application logs indicating malformed SQL queries
• Unexpected administrative access or authentication events from unknown IP addresses
• Database audit logs showing queries with injection patterns or unauthorized data access

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to /admin/login.php
• Implement input validation monitoring to identify requests containing SQL metacharacters (', --, ;, UNION, SELECT)
• Enable detailed logging on the web server for all requests to administrative endpoints
• Configure database audit logging to capture and alert on anomalous query patterns

Monitoring Recommendations

• Monitor HTTP access logs for suspicious activity targeting /admin/login.php with unusual payload lengths or encoded characters
• Set up alerts for multiple failed login attempts followed by successful authentication, which may indicate exploitation
• Review database query logs for evidence of UNION-based injection or error-based extraction techniques
• Implement network traffic analysis to detect exfiltration of database content

How to Mitigate CVE-2025-1965

Immediate Actions Required

• If using Projectworlds Online Hotel Booking 1.0, restrict access to the admin login page via IP allowlisting or VPN
• Deploy a Web Application Firewall with SQL injection rules to protect the vulnerable endpoint
• Review database logs and application access logs for signs of prior exploitation
• Consider taking the application offline until a patch is available or the vulnerability is remediated manually

Patch Information

No official vendor patch has been identified in the available CVE data. Organizations using this software should monitor the VulDB entry and GitHub issue for updates on remediation options. Given the open-source nature of this project, organizations may need to implement manual code fixes or consider alternative software solutions.

Workarounds

• Implement prepared statements/parameterized queries in the /admin/login.php file to prevent SQL injection
• Add server-side input validation to reject SQL metacharacters in the emailusername field
• Restrict network access to administrative endpoints using firewall rules or .htaccess configurations
• Deploy a reverse proxy with WAF capabilities to filter malicious requests before they reach the application

# Example .htaccess restriction for admin directory
<Directory "/path/to/hotel/admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>