Security readout for executives and security teams
Plain-English summary
Online Hotel Booking System Pro 1.2 has a SQL injection issue in roomtype-details.php through the tid argument. A remote attacker with low privileges could affect database confidentiality, integrity, and availability. Public exploit information exists, but the provided sources do not show active exploitation or name a vendor patch.
Executive priority
Treat this as a targeted remediation item, not an emergency by default. Public exploit disclosure raises risk, but the score is medium and sources do not confirm active exploitation. Internet-facing deployments should be prioritized.
Technical view
CVE-2017-20125 is CWE-89 SQL injection in /roomtype-details.php. The vulnerable input is tid. CVSS 3.1 is 6.3 with network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and low C/I/A impact.
Likely exposure
Exposure is limited to organizations running Online Hotel Booking System Pro version 1.2, especially if the application is internet-facing or accessible to untrusted users.
Exploitation context
The exploit has been publicly disclosed according to the CVE description and references. CISA KEV status is false in the supplied bundle, and no cited source confirms active exploitation in the wild.
Researcher notes
Evidence identifies the product, version, file, parameter, weakness class, and CVSS vector. The affected functionality beyond the file is described as unknown. Sources do not provide a named patch, vendor advisory, or confirmed exploitation status.
Mitigation direction
- Check vendor or project guidance for a fixed release; none is named in the sources.
- Restrict access to the affected application until remediation is confirmed.
- Prioritize replacing or retiring unsupported Online Hotel Booking System Pro 1.2 deployments.
- Review application code for parameterized handling of the tid input.
- Monitor web and database logs for unusual requests to roomtype-details.php.
Validation and detection
- Inventory systems for Online Hotel Booking System Pro version 1.2.
- Confirm whether /roomtype-details.php is deployed and reachable.
- Review server-side handling of the tid parameter for unsafe SQL construction.
- Check authentication requirements and who can access the affected route.
- Review logs for suspicious activity involving roomtype-details.php and tid.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-20125 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L2.83.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exploit-db.com/exploits/41181/CVE reference · x_refsource_MISC
- https://vuldb.com/?id.96625CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.