Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-8380: Campcodes Online Hotel Reservation System 1.0 allows remote code execution via malicious input

CVE-2025-8380 · published 1 year ago

Summary

Campcodes Online Hotel Reservation System version 1.0 has a security flaw that allows hackers to inject malicious code into the system through a vulnerable webpage. This could potentially allow an attacker to take control of the system. We recommend that users update to the latest version of the software to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
campcodes	online_hotel_reservation_system	1.0 `cpe:2.3:a:campcodes:online_hotel_reservation_system:1.0:::::::*`

Original advisory text

A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/add_query_account.php. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

https://github.com/XiaoJiesecqwq/sql/issues/3 Exploit Issue Tracking
https://vuldb.com/?ctiid.318358 Permissions Required VDB Entry
https://vuldb.com/?id.318358 Third Party Advisory VDB Entry
https://vuldb.com/?submit.624842 Third Party Advisory VDB Entry
https://www.campcodes.com/ Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.0 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-94Code Injection

Timeline

Published31 Jul 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-8380 · NVD

Track software like this

Free during beta