External risk intelligence

Car-Booking-System-PHP SQL Injection Vulnerability in Forgot Password Function.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-63452

The vulnerability exists in a car booking system web application. Such applications are typically deployed as public-facing web services to allow users to search and reserve vehicles over the internet, making the web interface and its associated scripts, such as password recovery pages, commonly accessible to external traffic.

SQL Injection

Car Booking System Php Project Car Booking System Php

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a car booking system, specifically impacting its password recovery function. This flaw could allow unauthorized access and manipulation of data if exploited through the network. The main concern at this time is to confirm if this specific system is in use and if it is exposed to external access.

SQL injection flaw in password reset.
Critical flaw could expose sensitive data.
Confirm relevance and exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to the password recovery feature of a car booking system. This feature is exposed on the network and accessible without any authentication, allowing an attacker to potentially manipulate database queries. Successful exploitation could lead to unauthorized access to sensitive data, modification of records, and denial of service.

No authentication required for access.
SQL injection in password recovery script.
Unauthorized data access and system disruption.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability in the Car-Booking-System-PHP application could allow an attacker to manipulate database queries. This could potentially lead to unauthorized access to or modification of system and user data stored within the booking system, affecting its normal operation.

Database data and system integrity.
Via network requests to the application.
Unauthorized access and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners responsible for the Car-Booking-System-PHP should investigate this SQL injection vulnerability. The first practical step is to identify all instances of the system, confirm their exposure to the internet, and determine which are business-critical. Once accountable owners are identified, a remediation plan can be developed based on the assessed risk.

Application owners should address the issue.
Verify system exposure and criticality first.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Car-Booking-System-PHP?

Car-Booking-System-PHP is a web-based application designed to manage vehicle reservations. It provides functionality for users to search for cars and book them online. Version 1.0 includes specific scripts, such as password recovery pages, that handle user accounts and interactions with the underlying database to process booking requests.

What does CVE-2025-63452 mean by SQL Injection?

This vulnerability belongs to the CWE-89 weakness class, which refers to improper neutralization of special elements used in a SQL command. In this case, the application fails to safely process user-supplied input before passing it to the database. An attacker can use this flaw to insert their own SQL queries, effectively tricking the system into revealing, changing, or deleting sensitive information stored in the application's database.

How is the password recovery feature triggered?

The vulnerability is triggered by sending specially crafted inputs directly to the /carlux/forgot-pass.php script. This process does not require any prior authentication or user account validation. Note that simply viewing or navigating to the password reset page without submitting malicious database commands does not execute the flaw.

Is my system at risk?

According to the Halo Surface Signal, this vulnerability is particularly relevant to systems accessible via the internet. Because car booking applications are typically deployed as public-facing services to allow remote reservations, the password recovery script is likely reachable by external traffic, increasing the probability that an unauthorized actor could reach the vulnerable code.

How should I respond to this vulnerability?

Start by performing an inventory of your environment to identify any instances of the Car-Booking-System-PHP application. Once located, confirm which systems are exposed to the internet and assess their business importance. After identifying these assets and their accountable owners, prioritize the development of a remediation plan based on your risk profile.

References

github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-13

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.