CVE-2025-8960: Flight Booking Management System SQLi Flaw

CVE-2025-8960 Overview

A SQL injection vulnerability has been discovered in Campcodes Online Flight Booking Management System version 1.0. The vulnerability exists in the /admin/save_airlines.php file, where improper handling of the ID parameter allows attackers to inject malicious SQL commands. This flaw enables remote attackers to manipulate database queries without authentication, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive flight booking data, manipulate airline records, or potentially gain unauthorized access to the underlying database server.

Affected Products

• Campcodes Online Flight Booking Management System 1.0
• /admin/save_airlines.php endpoint

Discovery Timeline

• August 14, 2025 - CVE-2025-8960 published to NVD
• August 14, 2025 - Last updated in NVD database

Technical Details for CVE-2025-8960

Vulnerability Analysis

This SQL injection vulnerability (CWE-74: Injection) affects the administrative functionality of the Campcodes Online Flight Booking Management System. The vulnerable endpoint /admin/save_airlines.php fails to properly sanitize the ID parameter before incorporating it into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL commands that are then executed by the database server.

The vulnerability is accessible remotely over the network and requires no authentication or user interaction to exploit. While the immediate impact is classified as limited confidentiality, integrity, and availability breaches, successful exploitation could enable attackers to enumerate database contents, extract sensitive customer booking information, or modify airline records stored in the system.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the save_airlines.php file. The application directly concatenates user-supplied input from the ID parameter into SQL statements without proper sanitization or the use of prepared statements. This classic SQL injection pattern allows malicious input to escape the intended query context and execute arbitrary database commands.

Attack Vector

The attack can be launched remotely via HTTP requests to the /admin/save_airlines.php endpoint. An attacker crafts a malicious request containing SQL injection payloads in the ID parameter. Since the application lacks proper input validation, the injected SQL code is processed by the database engine, allowing the attacker to:

1. Extract sensitive data from the database using UNION-based or error-based injection techniques
2. Modify or delete existing airline records
3. Potentially escalate access to other database tables containing customer booking information
4. In some configurations, execute system commands through database-specific functions

The vulnerability has been publicly disclosed, and detailed exploitation information is available through external references including Yuque Vulnerability Details and VulDB.

Detection Methods for CVE-2025-8960

Indicators of Compromise

• Unusual HTTP requests to /admin/save_airlines.php containing SQL syntax characters such as single quotes, double dashes, or UNION keywords in the ID parameter
• Database error messages appearing in application logs or HTTP responses indicating malformed SQL queries
• Unexpected database queries or access patterns in database audit logs
• Evidence of data exfiltration or unauthorized modifications to airline records

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to /admin/save_airlines.php
• Monitor web server access logs for requests containing common SQL injection payloads such as ' OR '1'='1, UNION SELECT, or -- comment sequences
• Enable database query logging and alert on unusual query patterns or errors originating from the flight booking application
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Configure real-time alerting for HTTP 500 errors or database exceptions from the affected endpoint
• Establish baseline behavior for normal administrative operations and alert on deviations
• Monitor for bulk data access patterns that may indicate data exfiltration attempts
• Review database user account activity for the application's service account

How to Mitigate CVE-2025-8960

Immediate Actions Required

• Restrict network access to the /admin/save_airlines.php endpoint using firewall rules or access control lists
• Implement a Web Application Firewall (WAF) with SQL injection protection rules in front of the application
• If possible, temporarily disable the affected administrative functionality until a patch is available
• Review database access logs for evidence of prior exploitation attempts

Patch Information

At the time of this publication, no official vendor patch has been released for this vulnerability. Organizations using the Campcodes Online Flight Booking Management System should monitor the CampCodes website for security updates and apply patches immediately when available.

Workarounds

• Implement input validation on the ID parameter to accept only numeric values
• Modify the application code to use prepared statements or parameterized queries instead of string concatenation
• Deploy a reverse proxy or WAF to filter malicious SQL injection payloads before they reach the application
• Restrict database user privileges for the application to limit the impact of successful exploitation

# Example WAF rule for ModSecurity to block SQL injection attempts
SecRule ARGS:ID "@rx (\b(union|select|insert|update|delete|drop|alter)\b|[\'\"\;])" \
    "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt Blocked in ID parameter'"