by Kastro
Paper/Archive/CVE-2025-12857

CVE-2025-12857

code-projects Responsive Hotel Site — code-projects Responsive Hotel Site roombook.php sql injection

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.6.356 × 207.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook.php. Such manipulation of the argument rid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Affected

ProductAffectedFixed inSource
Responsive Hotel Site1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
VulDB (CNA)4.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDB (CNA)4.7CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.331503refvuldb.com/?ctiid.331503writeupvuldb.com/?submit.679745exploitgithub.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/roombook-sql-injection/report.mdrefcode-projects.org