CVE-2025-6451: code-projects Simple Online Hotel Reservation System delete_pending.php sql injection
A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/deletepending.php. The manipulation of the argument transactionid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6451?
CVE-2025-6451 is classified as a critical severity vulnerability.
How does CVE-2025-6451 affect the Simple Online Hotel Reservation System?
CVE-2025-6451 allows for SQL injection through the manipulation of the transaction_id parameter in the /admin/delete_pending.php file.
What are the potential impacts of exploiting CVE-2025-6451?
Exploitation of CVE-2025-6451 can lead to unauthorized database access and data manipulation.
How do I fix CVE-2025-6451?
To fix CVE-2025-6451, validate and sanitize user input for the transaction_id parameter before processing queries in the application.
Is there a patch available for CVE-2025-6451?
As of now, there is no official patch available for CVE-2025-6451, so it is recommended to implement input validation as a workaround.