CVE-2025-45947 Code injection in n/a
Attackers can execute arbitrary code via the change-password component in the Online Banquet Booking System.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-45947?
CVE-2025-45947 is a critical code injection vulnerability in n/a, published on 28 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account - Change Password component
Weakness: CWE-94
Which versions are affected by CVE-2025-45947?
It affects 1 product.
Products include Phpgurukul Online Banquet Booking System.
How do I fix CVE-2025-45947?
No fix has been published for CVE-2025-45947 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-45947 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-45947 exists.
Other vulnerabilities in n/a
- CVE-2022-28992 Cross-site request forgery in n/a
- CVE-2025-2382 PHPGurukul Online Banquet Booking System booking-search.php sql injection
- CVE-2025-7925 PHPGurukul Online Banquet Booking System login.php cross site scripting
- CVE-2025-7927 PHPGurukul Online Banquet Booking System view-user-queries.php sql injection
- CVE-2025-2608 PHPGurukul Banquet Booking System view-user-queries.php sql injection
Sources
Also known as GHSA-rwf8-w7mh-r554.