A vulnerability

CVE-2025-0230 is a SQL injection flaw in code-projects Responsive Hotel Site affecting version 1.0, specifically the /admin/print.php path where the pid parameter is not safely handled. Public PoC material says an attacker can manipulate pid to alter backend SQL queries, which means data readout, tampering, or destructive queries against the app database are plausible if the page is reachable.

The vendor/CNA MEDIUM score is still a bit generous for enterprise prioritization. The decisive friction is that the vulnerable endpoint lives under /admin/ and the CNA vector says PR:L, so this is not a clean internet-scale pre-auth exploit; it is a post-auth app-layer bug in a lightly maintained sample PHP project that the vendor itself documents for localhost XAMPP/WAMP-style deployment.

Why this verdict

• Post-auth, not pre-auth: the CNA vector is PR:L, so the exploit chain starts after the attacker already has credentials or a session.
• Reachability is narrow: the vulnerable code is under /admin/print.php, which removes a lot of opportunistic anonymous scanning value.
• Tiny real deployment population: the vendor page describes localhost XAMPP/WAMP use for a free sample project, not a broadly deployed enterprise product.
• Threat telemetry is cold: no KEV listing, no active exploitation evidence found, and EPSS is near zero.
• Blast radius is usually app-local: compromise is meaningful for this app and DB, but there is no evidence here of direct OS-level code execution.

Why not higher?

If this were unauthenticated on a mainstream internet-facing product, the score would climb fast. But every real-world friction point pushes the other way: niche software, likely dev/lab installs, admin-path reachability, and a PR:L requirement. NVD's 9.8 enrichment looks like a vacuum-score mistake for operational prioritization.

Why not lower?

It is still bona fide SQL injection with public exploit guidance, not a theoretical bug. If you do run this app and the admin area is reachable to untrusted users or weak credentials exist, an attacker can likely read or alter the app database, so IGNORE would be too dismissive.

1. Pull the admin path behind identity controls — Require VPN, reverse-proxy auth, IP allowlisting, or equivalent in front of /admin/. For a LOW noisgate verdict there is no SLA; treat this as backlog hygiene, but do it whenever the app is still exposed to anything broader than trusted admins.
2. Block obvious SQLi patterns at the edge — Add WAF rules for UNION, comment markers, stacked queries, and time-based payloads on pid requests to print.php. This is a containment move when no official patch is available; for LOW, there is no deadline pressure, but it is worth doing if you cannot retire the app.
3. Constrain the database account — Ensure the PHP app uses a DB account without schema-altering or file-write privileges. That reduces SQLi impact from 'full DB abuse' to 'nuisance/local data tampering' and is appropriate backlog work for a low-priority demo app.
4. Decommission or replace the sample app — The stronger long-term control is to remove tutorial/demo code from any environment that matters. No official fixed release was identified, so replacement or retirement is often cleaner than trying to maintain a fork.
5. Add authenticated DAST coverage — If this app must stay, scan it with credentials so /admin/ endpoints are actually tested. This is the right verification loop for low-priority but real app-layer bugs that unauthenticated scanners routinely miss.

Run this on the target web server or on a mounted copy of the application source tree. Invoke it as python3 verify_cve_2025_0230.py /var/www/html/responsive-hotel-site on Linux/macOS or py verify_cve_2025_0230.py C:\xampp\htdocs\responsive-hotel-site on Windows; it only needs read access to the app files.

#!/usr/bin/env python3
# verify_cve_2025_0230.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage / unreadable

import os
import re
import sys

TARGET = os.path.join('admin', 'print.php')

PATTERNS = [
    re.compile(r"\$_(GET|REQUEST|POST)\s*\[\s*['\"]pid['\"]\s*\]", re.I),
    re.compile(r"pid\s*=\s*\$_(GET|REQUEST|POST)", re.I),
    re.compile(r"select\s+.*\$[A-Za-z_][A-Za-z0-9_]*", re.I | re.S),
    re.compile(r"mysql_query\s*\(", re.I),
    re.compile(r"mysqli_query\s*\(", re.I),
]

SAFE_HINTS = [
    re.compile(r"prepare\s*\(", re.I),
    re.compile(r"bind_param\s*\(", re.I),
    re.compile(r"execute\s*\(", re.I),
    re.compile(r"intval\s*\(\s*\$_(GET|REQUEST|POST)\s*\[\s*['\"]pid['\"]\s*\]\s*\)", re.I),
    re.compile(r"filter_input\s*\(", re.I),
]


def find_target(root):
    direct = os.path.join(root, TARGET)
    if os.path.isfile(direct):
        return direct
    matches = []
    for base, _, files in os.walk(root):
        if 'print.php' in files and os.path.basename(base).lower() == 'admin':
            matches.append(os.path.join(base, 'print.php'))
    return matches[0] if matches else None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: verify_cve_2025_0230.py <app_root>')
        sys.exit(2)

    root = sys.argv[1]
    if not os.path.isdir(root):
        print('UNKNOWN - supplied path is not a directory')
        sys.exit(2)

    target = find_target(root)
    if not target:
        print('PATCHED - admin/print.php not found under supplied path')
        sys.exit(0)

    try:
        with open(target, 'r', encoding='utf-8', errors='ignore') as f:
            data = f.read()
    except Exception as e:
        print(f'UNKNOWN - cannot read {target}: {e}')
        sys.exit(2)

    has_pid = any(p.search(data) for p in PATTERNS[:2])
    has_sql = any(p.search(data) for p in PATTERNS[2:])
    has_safe = any(p.search(data) for p in SAFE_HINTS)

    if has_pid and has_sql and not has_safe:
        print(f'VULNERABLE - {target} references pid and appears to build/issue SQL without obvious parameterization')
        sys.exit(1)

    if has_pid and has_safe:
        print(f'PATCHED - {target} references pid but shows signs of input handling or prepared statements')
        sys.exit(0)

    if has_pid and not has_sql:
        print(f'UNKNOWN - {target} references pid, but the script could not confirm SQL usage')
        sys.exit(2)

    print(f'UNKNOWN - {target} did not match the expected vulnerable pattern')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2025-0230
2. code-projects Responsive Hotel Site page
3. Public PoC notes on GitHub
4. OpenCVE record
5. CISA Known Exploited Vulnerabilities Catalog
6. Shodan CVEDB product page
7. Feedly CVE page with EPSS summary
8. Indusface January 2025 bulletin