External risk intelligence

Car-Booking-System-PHP 1.0 SQL Injection in Contact Form

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63453

The vulnerability exists in a contact form page of a web-based booking system. Such applications are typically deployed as public-facing web services to allow users to interact with the system, making the contact module and its associated input parameters reachable from the internet in common deployments.

SQL Injection

Car Booking System Php Project Car Booking System Php

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Car Booking System PHP software, specifically within its contact form functionality. This flaw allows for unauthorized data manipulation, potentially impacting the integrity and availability of system information. The primary concern is to determine if this specific software and version are in use within our environment.

It allows unauthorized access to system data.
Confirm its use to assess potential risk.
Verify usage to understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable `contact.php` script on a Car-Booking-System-PHP v.1.0 installation accessible from the internet. By sending specially crafted input to this script, an attacker could manipulate the database queries executed by the application. If successful, this manipulation could allow an attacker to read sensitive data, modify existing data, or even delete data within the system, depending on the underlying database and application logic.

Accessible over the network.
User-supplied input in contact form.
Data theft, modification, or deletion.

Live Threat

Current exploitation, exposure, and threat context

A critical SQL injection vulnerability in the Car-Booking-System-PHP's contact form could allow an attacker to execute arbitrary SQL commands. This could affect the integrity and availability of the booking system's underlying database when the contact feature is accessible.

Database integrity and availability.
Via unauthenticated network requests.
Disruption of booking services.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Car-Booking-System-PHP application, specifically version 1.0, is affected by a critical SQL injection vulnerability in its contact form. This vulnerability is externally facing and accessible via the network, posing a significant risk to the system's integrity and data. The first practical step is to identify all instances of this system, confirm their exposure and business criticality, locate the accountable owner, and then prioritize remediation efforts based on the assessed risk.

Application owners should address this issue.
Verify external reachability and business impact.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Car-Booking-System-PHP?

Car-Booking-System-PHP is a web-based application designed to help businesses manage vehicle reservations. It typically runs on a web server using PHP and a backend database to store booking details, user information, and contact requests. Version 1.0 is the specific release identified with this security flaw.

What does SQL injection mean for CVE-2025-63453?

This vulnerability is classified as CWE-89, which occurs when an application improperly handles user-supplied data before including it in a database query. In this case, the contact form fails to sanitize input, allowing an attacker to inject their own malicious SQL commands to bypass security, access, change, or delete data within the application's database.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending specially crafted input into the fields of the contact form found in the /carlux/contact.php script. The vulnerability requires this specific script to be processed by the application; simply navigating to the website or interacting with other features that do not process form input through this vulnerable script will not trigger the SQL injection.

Why should I care about this SQL injection?

You should care because Halo Surface Signal indicates that this application is typically deployed as a public-facing service to collect user inquiries, making the vulnerable contact form reachable from the internet. If your instance is accessible to the public, unauthorized actors can interact with your database without needing any prior authentication or special access rights.

Do I need to take immediate action if I run this software?

Yes. Start by inventorying your environment to locate all instances of Car-Booking-System-PHP version 1.0. Once identified, confirm whether the specific contact form is active and accessible. Coordinate with the application owners to assess the business risk and plan for remediation steps, such as updating the software or securing the vulnerable script, during your next maintenance window.

References

github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-14

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.