CVE-2025-0340
Published: 09 January 2025
Summary
CVE-2025-0340 is a high-severity Injection (CWE-74) vulnerability in Code-Projects Cinema Seat Reservation System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements input validation and sanitization for the vulnerable 'id' argument in /admin/deleteBooking.php to block SQL injection payloads.
Requires timely identification, reporting, and correction of the specific SQL injection flaw in the Cinema Seat Reservation System.
Vulnerability scanning detects SQL injection vulnerabilities like CVE-2025-0340 in web applications for remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote SQL injection in a public-facing web application (/admin/deleteBooking.php) enables unauthenticated exploitation matching T1190.
NVD Description
A vulnerability classified as critical was found in code-projects Cinema Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/deleteBooking.php. The manipulation of the argument id leads to sql injection. The attack can be…
more
launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-0340 is a critical SQL injection vulnerability in code-projects Cinema Seat Reservation System 1.0. The issue resides in an unknown functionality of the file /admin/deleteBooking.php, where manipulation of the "id" argument triggers the injection. Published on 2025-01-09, it has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is linked to CWEs-74 and CWE-89.
The vulnerability enables remote exploitation by unauthenticated attackers requiring low attack complexity and no user interaction. Exploitation can result in low-level impacts to confidentiality, integrity, and availability. An exploit has been publicly disclosed and may be actively used.
Advisories and details are available via VulDB at https://vuldb.com/?ctiid.290827, https://vuldb.com/?id.290827, and https://vuldb.com/?submit.476707, as well as the project site at https://code-projects.org/. No specific patch or mitigation guidance is outlined in the initial disclosure.
Details
- CWE(s)