CVE-2025-6578 is a high severity (CVSS 7.3) SQL injection in code-projects Simple Online Hotel Reservation System 1.0. The admin_id argument of /admin/delete_account.php reaches a database query without safe handling. The record lists no fixed version, so limit exposure, parameterize the query or retire the application.
What's affected
The record names one version: code-projects Simple Online Hotel Reservation System 1.0. The vulnerable code is in /admin/delete_account.php. The weak input is the admin_id argument, and the record says the attack can be launched remotely without credentials and without any user interaction.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which scores 7.3. Impact on confidentiality, integrity and availability is each rated low, which is typical for a single injectable parameter. Low per-field ratings do not mean low risk for you. What an attacker can read or change depends on the database account the application uses and on what is stored there.
The record does not list a fixed version or a vendor patch. It does say the exploit has been disclosed publicly and may be used. It is not in the CISA Known Exploited Vulnerabilities catalog, and nothing I fetched says it is being exploited in the wild.
How to check if you're exposed
You are exposed if you run Simple Online Hotel Reservation System 1.0 from code-projects anywhere a network client can reach it. Start with an inventory. Find the file named in the record on your web servers:
find /var/www -type f -name "delete_account.php" 2>/dev/null
If the file is there, open it and look at how the admin_id value is used. A query built by joining the request value into a SQL string is the problem. A prepared statement with bound parameters is not.
Then look at your logs for the same path. A quick pass over the web server access log shows who has been calling it and how often:
grep "delete_account.php" /var/log/apache2/access.log | head -50
Unusually long query strings, repeated requests from one address or database error messages in responses all deserve a closer look. Adjust the log path for your server. If the app is behind a reverse proxy, check those logs as well.
What to do now
- Find every instance of Simple Online Hotel Reservation System 1.0 in your environment, including test and demo copies that people forget about.
- Check the vendor page and the public report listed under Sources for any update. The record does not confirm a fixed version, so do not assume one exists.
- If the application is not needed, take it offline or remove it.
- If it must stay, remove public access. Put it behind a VPN or an IP allow list, and require authentication in front of it at the web server.
- Fix the query. Replace string concatenation with prepared statements and bound parameters, and validate the admin_id value against the type you expect.
- Reduce what the database account can do. The application should not connect as a database administrator.
- Review logs and the database for unexpected reads or changes since the record was published on 2025-06-24.
Why it matters
SQL injection (CWE-89) happens when input from a request is placed into a database query as code instead of as data. The parent class, CWE-74, covers injection into any downstream interpreter. The fix has been known for decades: separate the query text from the values, and let the database driver handle the values.
Because the record lists no vendor fix, a flaw like this stays live for as long as the application runs unless someone patches the code. A dependency scan will not find this kind of bug, because it sits in the application's own code. A code scan does. The free Safeguard dependency scan covers the libraries you ship, and the Gold page for CVE-2025-6578 tracks the record for this CVE.
Quick check
Is CVE-2025-6578 exploited in the wild?
Not according to the sources I checked. The record's KEV flag is false, so it is not in the CISA catalog. The record does say a public exploit exists and may be used, which is reason enough to act.
Is there a patched version of Simple Online Hotel Reservation System?
The record lists none. Check the vendor site and the linked report. If nothing is published, fix the query yourself or retire the application.
Sources
Last reviewed: 18 October 2026.
