CVE-2025-4066 is a high improper access control flaw in ScriptAndTools Online-Travling-System, with a CVSS score of 7.3. The record names no fixed version, so check with the maintainer. Treat any instance reachable from untrusted networks as exposed until you have confirmed the fix, and review your logs for unexpected requests.
What's affected
- Product: ScriptAndTools Online-Travling-System 1.0, a PHP travel booking project.
- Fixed version: The record does not name a fixed version.
- Severity: High, CVSS 7.3 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
- Weakness: CWE-266 and CWE-284.
- Published: 2025-04-29.
The record points at the file /admin/addpackage.php, where the manipulation of an unspecified input leads to improper access controls. The record says the attack can be started remotely and that the exploit has been disclosed to the public.
The record carries two weakness types, CWE-266 and CWE-284, both about permissions being wrong. The score of 7.3 is a High rating, not Critical.
How to check if you're exposed
This is source code you host yourself, so you can search for the file and parameter named in the record:
grep -rn '\$_GET\|\$_POST\|\$_REQUEST' --include=*.php . | grep -i 'query'
The command lists lines where request input and a database query appear together. Read each hit and look for values placed straight into the SQL text. It is a starting point for review, not proof of safety.
You can also run your dependency manifests and container images through the free in-browser scan to see which known CVEs affect the packages you ship. It will not find a flaw inside a vendor appliance or an unmanaged install, so keep an inventory of those too.
What to do now
- Identify every copy of ScriptAndTools Online-Travling-System you run, including test and forgotten ones.
- Search the project page and your vendor channel for a newer release. If none exists, treat the admin area as untrusted and restrict it by network or remove it.
- Until that is done, remove public access where you can. Put the application behind a VPN, a network allow list or a web application firewall rule, and watch the access and database logs for unusual requests to the endpoint named above.
- Record the outcome, including the date, the version you ended on and who confirmed it, so a later audit has something to read.
- Add the product to your continuous monitoring so a future CVE against it reaches you without a manual search.
Why it matters
Improper access control covers cases where the application does not correctly limit who may do what. In an admin area this often means a page that adds or changes data is reachable without the right role, or without any login. The classes are catalogued as CWE-266 (incorrect privilege assignment) and CWE-284 (improper access control).
The remedy is to check the user's session and role on the server at the start of every admin page, and to deny by default. A network allow list in front of the admin folder is a sensible stopgap while the code is fixed.
The record's KEV flag is false, so CISA does not list it as known to be exploited, and nothing in the sources here says it is being exploited in the wild.
Try it yourself
See how the vulnerability management step works in practice.
Click through it at your own pace, or open it full screen.
Quick check
What does the score of 7.3 mean for ScriptAndTools Online-Travling-System?
The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L reads as network reachable, low complexity, no privileges and no user interaction. The impact ratings are confidentiality low, integrity low, availability low. Use it to rank the work, then confirm exposure for your own deployment.
Does an unlinked admin page count as protected?
No. If the server does not check the session and role, anyone who requests the address can use the page. Access control has to be enforced on the server, not by hiding the link.
Sources
Last reviewed: 18 October 2026.
