CVE-2025-14711 covers a high severity SQL injection (CVSS 7.3) in FantasticLBP Hotels Server (a rolling release project), in /controller/api/hotelList.php. The pickedHotelName/type argument feeds a database query unsafely. No fixed version appears in the record. Take the app off the open internet and switch the query to bound parameters.
What's affected
The record names FantasticLBP Hotels Server, releases up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0. The project uses a rolling release model, and the record says version information for affected or updated releases is unavailable. That means you cannot rely on a version number to know whether you are safe.
Here is what the record and its scoring say:
- Severity: High, CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Network reachable, low complexity, no privileges and no user interaction required, according to that vector.
- Impact is scored as low for each of confidentiality, integrity and availability.
- Fixed version: none listed in the record.
- The record states the vendor was contacted before disclosure and did not respond.
- Exploitation in the wild: the record is not in the CISA KEV catalog. It does say exploit details have been made public.
A public write up exists on GitHub and is linked from the record. This post does not reproduce its test details.
How to check if you're exposed
This is application code, not a package you install from a registry, so start with a file search on the server or in your repositories.
# Is the application present?
grep -ril "hotelList.php" /var/www 2>/dev/null
# Does your web server log show traffic to the page?
grep "hotelList.php" /var/log/nginx/access.log | tail -n 50
Then open hotelList.php and find where pickedHotelName/type is read. If its value is joined into an SQL string, you have the flaw described here. If it is passed to a prepared statement as a bound value, that path is not affected by this class of bug.
Also look at the log lines for unusual characters or very long values in the query string. Odd entries are a prompt to investigate, not proof of compromise.
What to do now
- Find every copy of the application, including test and staging servers.
- Take it off the public internet, or put it behind a VPN or an IP allow list, until the code is fixed.
- Check the vendor site for a patched release. The record lists none, so do not assume one exists.
- Rewrite the query in
hotelList.phpso values are bound as parameters, never joined into the SQL text. - Give the application's database account only the rights it needs. It should not own the schema or read unrelated tables.
Why it matters
The weakness here is classed as CWE-89, SQL injection, under the broader CWE-74. The application treats request data as trusted query text. The scores are 'low' for each impact area, but that is a per request rating. A database often holds far more than one page needs, which is why least privilege on the database account is worth the effort.
Quick check
Is there a patched version of Hotels Server?
The CVE record lists no fixed version and the references I could see are not a vendor patch. Check FantasticLBP's site, and do not rely on a release number alone. Fixing the query in your own copy is the dependable route.
Is this being exploited in the wild?
The record is not in CISA KEV, and nothing I read says exploitation has been confirmed. It does say exploit details have been made public, so treat exposure as real.
Sources
Last reviewed: 19 October 2026.
