High · published December 15, 2025
⚠️ A sneaky SQL injection lurks in the FantasticLBP Hotels Server! An attacker could manipulate the telephone argument and execute remote queries. 🔥 This vulnerability is like a hotel receptionist who takes a phone call without verifying who’s on the other end — they might unwittingly give out sensitive information simply because they didn’t check credentials. An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially allowing them to read, modify, or delete critical information. This could lead to data breaches that compromise customer privacy and trust. Yikes!
This vulnerability is like a hotel receptionist who takes a phone call without verifying who’s on the other end — they might unwittingly give out sensitive information simply because they didn’t check credentials. This SQL injection vulnerability in the OrderList.php file allows an attacker to manipulate input fields, specifically the telephone number, leading to unauthorized database queries.
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially allowing them to read, modify, or delete critical information. This could lead to data breaches that compromise customer privacy and trust. Yikes! Ensure you update your FantasticLBP Hotels Server to a fixed version as soon as it becomes available. Additionally, validate and sanitize all user inputs to protect against SQL injection. Don’t forget to monitor your logs for any suspicious activity! You've got this! Follow these steps, and you'll have your security on lock in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fantasticlbp/hotels_server | ≤ 2019-03-23 | — |