CVE-2025-9009 is a High severity (CVSS 7.3) SQL injection in itsourcecode Online Tour and Travel Management System 1.0. The Name parameter of /admin/email_setup.php reaches a database query unsafely, and the attack can be made remotely. No fixed version is confirmed, so restrict or retire the app and fix the query in code.
What's affected
Per the record, the affected product is itsourcecode Online Tour and Travel Management System, version 1.0. The weak spot is the file /admin/email_setup.php, where manipulation of the argument Name leads to SQL injection. The record says the attack can be launched remotely and scores it 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms that means network reachable, low complexity, no privileges and no user interaction, with limited impact on confidentiality, integrity and availability.
The record says the exploit has been disclosed to the public and may be used.
The record and the sources reviewed list no fixed version. The reporter issue we read lists no vendor response either, so treat every copy of this version as vulnerable until the project or your own team patches it. If you downloaded the source and modified it, your copy may differ, so review it rather than assuming.
How to check if you're exposed
These apps are normally deployed as plain PHP source, so there is no package version to query. Work from the code and the web server instead.
- Find every copy. Search your servers and repositories for the file name, for example with
find / -name "email_setup.php" 2>/dev/nullon a Linux host, then check whether the surrounding project is Online Tour and Travel Management System. - Open the file and look at how Name is used. If the value is joined into a query string rather than bound as a parameter, that copy is exposed.
- Check your web server logs for requests to /admin/email_setup.php with unusual characters in Name. Repeated errors from the database are a signal worth escalating.
- Confirm whether the application is reachable from the internet or only from an internal network. That changes how fast you need to move.
If you are unsure what runs on a host, run the free in-browser dependency scan on your dependency files, and use the Gold directory to look up other known issues in the same product.
What to do now
- Take the application off the public internet, or put it behind authentication and an IP allowlist, until it is fixed.
- Replace the vulnerable query with a prepared statement that binds Name as a parameter. Do the same for every other query in the project, because one injectable script often means more.
- Run the database account the app uses with the least privilege it needs. It should not be able to read unrelated schemas or write outside its own tables.
- Check the vendor or project page for a patched release, and read its notes before you deploy. Do not assume a newer download fixes this specific file.
- Review logs and the database for signs of tampering, and rotate any credentials stored in the affected tables if you see anything odd.
- If the project is abandoned, plan to replace it. Patching one parameter will not make an unmaintained codebase safe.
Why it matters
The weakness class is CWE-89 (SQL injection), filed under the broader CWE-74 (injection). The application builds a SQL statement from request data, so an attacker who controls that data can change what the statement does. The usual outcomes are reading records, altering them, or in some setups bypassing a login.
Input reaches a query unchecked. That is the whole story of this class of flaw, and the fix is equally well known. The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and we have no report of active attacks, but public disclosure alone means scanners can add a check quickly. Small open source and example projects are often deployed as is, which is why a "High" injection score deserves attention even when the product looks minor.
Quick check
Is there a patch for CVE-2025-9009?
None is confirmed in the sources we reviewed. Check the project page for a newer release, and fix the query in your own copy by binding Name as a parameter.
Is this being exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and we found no advisory saying it is exploited. The record does say exploit details are public.
Sources
Last reviewed: 18 October 2026.
