CVE-2025-0230
Published: 05 January 2025
Summary
CVE-2025-0230 is a medium-severity Injection (CWE-74) vulnerability in Fabian Responsive Hotel Site. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by validating the 'pid' argument in /admin/print.php against malicious input.
SI-2 requires identification, reporting, and correction of the specific SQL injection flaw in Responsive Hotel Site 1.0.
RA-5 enables vulnerability scanning to detect the SQL injection vulnerability in /admin/print.php as a known CVE.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in /admin/print.php enables exploitation of public-facing web applications (T1190), abuse of server software components for malicious SQL execution (T1505), and collection of data from databases via UNION queries (T1213.006).
NVD Description
A vulnerability, which was classified as critical, was found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file /admin/print.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0230 is a critical SQL injection vulnerability (CWE-74, CWE-89) in code-projects Responsive Hotel Site 1.0. The flaw resides in an unknown function within the file /admin/print.php, where manipulation of the "pid" argument enables SQL injection. The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-05.
Attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required, but it necessitates low privileges such as a standard authenticated user account. Successful exploitation allows limited impacts, including partial unauthorized disclosure of sensitive data (C:L), minor manipulation of data or configuration (I:L), and limited denial of service (A:L).
VulDB advisories (ctiid.290226, id.290226) and related submissions detail the issue, while a GitHub repository at Huandtx/cve contains a public proof-of-concept exploit in sql1.md. The code-projects.org vendor page is referenced, but no specific patches or mitigations are outlined in the disclosure. Security practitioners should monitor these sources for updates and apply input sanitization or access controls to the affected endpoint as interim measures. The exploit has been publicly disclosed and may be in use.
Details
- CWE(s)