CVE-2025-45947: Arbitrarily Executable Code Vulnerability in Online Banquet Booking System V1.2

Overview

The vulnerability CVE-2025-45947 is a critical security flaw that resides in the phpgurukul Online Banquet Booking System V1.2. It enables an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account – Change Password component. The vulnerability affects any businesses or individuals utilizing the Online Banquet Booking System V1.2. It’s highly significant because it holds the potential for system compromise or data leakage, leading to drastic security breaches and financial losses.

Vulnerability Summary

CVE ID: CVE-2025-45947
Severity: Critical (CVSS: 9.8)
Attack Vector: Change Password component
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Online Banquet Booking System | V1.2

How the Exploit Works

The vulnerability allows an attacker to inject malicious code through the Change Password component. The /obbs/change-password.php file fails to adequately sanitize user-supplied input, thus permitting the execution of arbitrary code. This code can then be used to exploit the system, leading to potential unauthorized access, data theft, or worse: full system control.

Conceptual Example Code

Here is a conceptual example of how the vulnerability might be exploited. In this case, the malicious code is sent through a POST request to the change-password.php endpoint:

POST /obbs/change-password.php HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
new_password={ "malicious_payload": "..." }

In the example above, the attacker sends a POST request containing the malicious payload in the ‘new_password’ parameter. This payload could be crafted to execute any arbitrary code that the attacker desires.

Mitigation and Prevention

To mitigate this vulnerability, users of the Online Banquet Booking System V1.2 should apply the vendor patch as soon as possible. If a patch is not yet available or cannot be applied immediately, it is recommended to use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) as a temporary mitigation. Regular updates and a strong cyber hygiene practice can also help prevent such vulnerabilities in the future.