CVE-2025-1962

CVE-2025-1962 is a critical SQL injection vulnerability in projectworlds Online Hotel Booking version 1.0, affecting an unknown part of the file /admin/addroom.php. The issue arises from improper neutralization of the 'roomname' parameter (CWE-74, CWE-89), allowing remote attackers to manipulate this input and execute arbitrary SQL queries. Published on 2025-03-05, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and low complexity.

Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction by sending crafted requests to the vulnerable endpoint. Successful exploitation enables limited impacts, including low-level disclosure of sensitive information (C:L), modification of data (I:L), and denial of service (A:L), potentially allowing attackers to extract or alter database contents related to hotel room management.

Advisories from VulDB and a related GitHub issue note that the exploit has been publicly disclosed and may be actively used. Practitioners should review the references (e.g., https://vuldb.com/?id.298563, https://github.com/ubfbuz3/cve/issues/1) for detailed proof-of-concept details and apply updates if available for the affected software.