CVE-2025-6418: High SQL Injection in Simple Hotel Reservation 1.0

CVE-2025-6418 is a high severity (CVSS 7.3) SQL injection in code-projects Simple Online Hotel Reservation System 1.0. The Name argument handled by /admin/edit_query_account.php reaches a database query without safe handling. The record lists no fixed version, so remove the app from public view and fix the query code.

What's affected

The record names one affected product and version: code-projects Simple Online Hotel Reservation System 1.0, published by code-projects (the CPE vendor is listed as fabian). The weak spot is the file /admin/edit_query_account.php and its Name argument. The CVSS vector shows network access, low complexity and no privileges needed, with low impact on confidentiality, integrity and availability, for a base score of 7.3.

The description says the exploit has been disclosed to the public and may be used. It does not say anyone is attacking systems, and the record does not mark the CVE as a CISA Known Exploited Vulnerability.

There is no fixed version in the record. The text does not mention a vendor patch. Check the project page at code-projects.org for any update before you decide how to proceed.

How to check if you're exposed

Because there is no package version to query, start with your own inventory. Search your servers and repositories for the file named in the advisory:

find / -type f -name 'edit_query_account.php' 2>/dev/null

If the file exists, read how it builds its database query. A query assembled by joining request values into a string is the pattern to look for:

grep -nE 'mysqli_query|mysql_query|->query\(' edit_query_account.php

Then check exposure. Is the application reachable from the internet? Is the admin area open to everyone, or limited by address? Your web server logs may show unusual values in the Name field, such as quote characters or long strings of SQL keywords. If your copy was renamed or modified, search by function and parameter name as well as by file name. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan on a manifest to see what else you have in the same project.

What to do now

1. Take code-projects Simple Online Hotel Reservation System 1.0 off the public internet, or restrict it to a trusted network or VPN until it is fixed.
2. Check code-projects.org and the issue linked below for a patch. The record names none, so do not assume one exists.
3. Change the code that handles Name in /admin/edit_query_account.php to use prepared statements with bound parameters, and validate the input type.
4. Run the database account used by the app with the least privileges it needs, with no rights to other schemas or to file operations.
5. Review web and database logs for odd requests to the affected page, and back up the database before you change anything.
6. If the app holds real customer data, treat the exposure period as a possible incident and follow your breach process.

Why it matters

The record lists CWE-89, improper neutralization of special elements in an SQL command, and its parent CWE-74, injection. The cause is old and well understood. User input is placed into a database query as text, so the database cannot tell the data from the command. The standard fix is a parameterized query, where the structure of the statement is fixed and values are sent separately.

This kind of flaw is common in PHP code that builds queries by hand. The risk to you depends on whether the app is live. For a copy running a real business, a publicly known weak point in a login or admin page deserves quick action. For a learning exercise on a laptop, the fix is a good chance to practice safe queries.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Public report in the project issue tracker (listed in the record)
• VulDB entry 313412 (listed in the record)
• code-projects.org (listed in the record)

Last reviewed: 18 October 2026.