High · published December 15, 2025
⚠️ A sneaky SQL injection vulnerability is lurking in FantasticLBP Hotels Server, and it opens the door to some unwanted guests! 🚪💥 Think of it as a hotel concierge who never checks the guest list; with just the right name, anyone could claim a room without proper verification. It's a mix-up in the reservation system that could lead to chaos! An attacker could manipulate the hotel name argument to execute unauthorized SQL queries. This means they could potentially access or modify sensitive data from the database, like guest information and booking details, which could be absolutely devastating for both guests and the hotel's reputation.
Think of it as a hotel concierge who never checks the guest list; with just the right name, anyone could claim a room without proper verification. It's a mix-up in the reservation system that could lead to chaos! This vulnerability allows remote attackers to perform SQL injection through the /controller/api/hotelList.php file. By manipulating the pickedHotelName/type parameter, they can run arbitrary SQL commands, leading to unauthorized data access or manipulation.
An attacker could manipulate the hotel name argument to execute unauthorized SQL queries. This means they could potentially access or modify sensitive data from the database, like guest information and booking details, which could be absolutely devastating for both guests and the hotel's reputation. Patch the FantasticLBP Hotels Server to the latest version, ensuring that input validation is robust and that prepared statements are used to prevent SQL injection. It's also wise to conduct an audit of related API endpoints for similar vulnerabilities. You've got this! With these steps, you’ll bolster your defenses and keep the hackers at bay! 🛡️✨
| Product | Versions | Fixed in |
|---|---|---|
| fantasticlbp/hotels_server | ≤ 2019-03-23 | — |