CVE-2025-11479 is a high severity SQL injection flaw (CVSS 7.3) in SourceCodester Wedding Reservation Management System 1.0, reached through the number argument in function.php. No fixed version is confirmed in the sources reviewed. Take the app off the public internet, replace the query with a prepared statement, and check the vendor for updates.
What's affected
- Product: SourceCodester Wedding Reservation Management System
- Affected: version 1.0
- Weak point: the number argument handled by function.php
- Fixed version: none confirmed. The researcher report linked below describes the flaw and does not point to a patched release, so treat every deployment of this version as exposed until the vendor says otherwise
The record describes the issue as remote, and the CVSS base score is 7.3 (HIGH). The CVSS vector says no account is needed, so anyone who can reach the page over the network is in scope.
The weakness is classified as CWE-89 (SQL injection) and its parent category CWE-74 (injection). Neither is specific to this product. They describe the same coding mistake, which is building a database query out of text the user controls.
How to check if you're exposed
Neither the record nor the researcher report names a package registry entry, so use these steps.
- Confirm the product and version. Look for Wedding Reservation Management System version 1.0 in your asset list and on disk.
- Locate the entry point with a search for the argument name.
grep -rIn "number" /path/to/app
- Read the query that follows. String concatenation means vulnerable. A prepared statement with bound values means the specific flaw is not present in your copy, although you should still verify with a test in a staging copy.
- Check logs for requests to function.php that include quote marks, comment markers or SQL keywords in the parameter.
You can also run a dependency and code scan in the browser. The free scan at gold.safeguard.sh/scan covers declared dependencies, so it will not read a PHP page for you, but it helps with the libraries around it.
What to do now
- Decide whether you need this app at all. If it is a demo or a learning project, shut it down and remove it from the server.
- If you must keep it running, restrict access. Put it behind a VPN, an IP allow list or HTTP authentication so it is not reachable by the open internet.
- Fix the query in function.php. Replace string concatenation with a prepared statement and bind number as a value. The pattern looks like this, with names changed to match your schema.
$stmt = $pdo->prepare("SELECT * FROM items WHERE id = :id");
$stmt->execute([':id' => $value]);
- Give the database account the app uses only the permissions it needs. An account that cannot drop tables or read other schemas limits the damage of any injection.
- Watch the vendor page and the researcher issue for a patched release, and review the advisory before you rely on one. No fixed version is confirmed here.
- Add the app to your dependency and code scanning so the next flaw in it does not wait for a headline.
Why it matters
The class of weakness here is injection. The application mixes code and data in one string, and the database interprets the visitor's input as part of the command. CWE-89 is the specific form.
Public exploit details raise the odds that someone tries it against exposed copies of Wedding Reservation Management System. The record does not flag active exploitation and the CISA KEV catalog does not list it. Still, small apps are scanned constantly, and a published parameter name is all a scanner needs to start.
The deeper lesson is that the fix is cheap and mechanical. Prepared statements close this whole class of bug for the query they cover, and a code scan can find the rest of the string built queries in the same project.
Quick check
Is there a patched version of Wedding Reservation Management System?
No fixed version is confirmed in the record or the report we reviewed. Check the vendor site and the project issue before relying on any update, and fix the query yourself if the source is under your control.
Is CVE-2025-11479 being exploited in the wild?
The record says an exploit is publicly available, but it is not in the CISA Known Exploited Vulnerabilities catalog and no source we reviewed reports attacks. Act as if scanning is likely.
Sources
- Researcher issue and write up
- CVE record and CVSS vector for CVE-2025-11479, as published on 2025-10-08
Last reviewed: 19 October 2026.
