CVE-2025-11404 is a Medium severity (CVSS 6.3) SQL injection in SourceCodester Hotel and Lodge Management System 1.0. The percentage argument handled by /pages/save_tax.php can change the database query. The record names no patched release, so restrict access, switch the query to prepared statements and ask the vendor for a fix.
What's affected
The record lists SourceCodester Hotel and Lodge Management System 1.0. The affected file is /pages/save_tax.php, and the argument named in the record is percentage. The weakness types are CWE-74 (injection) and CWE-89 (SQL injection). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means network reachable with a low privilege account needed.
The record says the exploit has been published. That is not the same as attacks being seen. The CVE is not in the CISA KEV catalog, and I found no advisory that reports use in the wild. Public exploit details still make scanning for the flaw easy, so exposed installs deserve attention.
No vendor advisory or fixed version is listed in the record, and I could not confirm one from the public issue report. Check the vendor's site, listed as a reference in the record, for updates. The same product has other CVEs in this period, including CVE-2025-11397, CVE-2025-11399, CVE-2025-11400, CVE-2025-11401, and more. A product with several injection points usually has more, so plan a review of the whole code base rather than one page.
How to check if you're exposed
First confirm you run this product. Look for the application folder on your web server and check the version in its readme, admin footer or release notes. The record only names 1.0, so treat other versions as unverified rather than safe.
Then look at the code. From the application's root directory, these commands show where the file lives and how the argument is used:
find . -name "save_tax.php"
grep -n "percentage" pages/save_tax.php
grep -rnE "(mysqli_query|mysql_query)" --include=*.php .
Any hit that builds a query by joining strings with the request value, rather than passing it as a bound parameter, is a candidate for this class of flaw.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allow list, while you decide what to do.
- Change the query that uses percentage so the value is bound as a parameter. Example of the safe shape in PHP:
$stmt = $mysqli->prepare("SELECT id FROM records WHERE name = ?");
$stmt->bind_param("s", $value);
$stmt->execute();
- Give the application's database account only the rights it needs. It should not own the schema or reach other databases.
- Search access logs for requests to /pages/save_tax.php that contain unusual characters in the percentage field, and keep them if you find any.
- Ask the vendor for a patch. If none is published, plan to replace the application, or maintain your own fixed copy of the code.
- Apply the same fix to every other page that builds queries from request values, since one bug often means several.
Why it matters
SQL injection happens when user input becomes part of a database command instead of being treated as data. The database then cannot tell the developer's intent from the attacker's text. The effect depends on the application and the database account, and ranges from reading rows to changing or deleting them.
Because the record lists no fixed version, you cannot fix this by upgrading. The code change and the network limits above are your real controls. The weakness classes are CWE-74 and CWE-89, both well understood and cheap to prevent in new code.
Quick check
Is there a patched version of SourceCodester Hotel and Lodge?
Not that the record shows. No fixed version is listed, so fix the query yourself or limit access until the vendor responds.
Is CVE-2025-11404 exploited in the wild?
The record says an exploit has been made public, which is different from reported attacks. The CVE is not in the CISA KEV catalog, and I found no advisory saying it is exploited. Public exploit details still raise the risk for exposed sites.
Sources
- Public issue report listed in the record
- NVD record for CVE-2025-11404 (description, CVSS vector, CWEs)
To find known issues in the open source libraries behind your own projects, run the free in-browser dependency scan.
Last reviewed: 19 October 2026.
