CVE-2025-10623

SourceCodester Hotel Reservation System deleteuser.php sql injection

A vulnerability was identified in SourceCodester Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteuser.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Affected

SourceCodester · Hotel Reservation System

CVSS v4.0 VULDB

5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 VULDB

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.48% chance of exploitation in the next 30 days, 40th percentile

Published

2025-09-17

Updated

2025-09-18

Proof-of-concept exploits (1)

• aCas1o/cve_report02/blob/main/report.md0★ · 2025-09-02

Security advisories

• https://vuldb.com/?id.324651
• https://vuldb.com/?submit.650221
• https://www.sourcecodester.com

References

• CVE Record
• NVD entry

Related

• CVE-2025-10621
• CVE-2025-11036
• CVE-2025-11037