CVE-2025-13242
📋 TL;DR
This SQL injection vulnerability in Student Information System 2.0 allows attackers to execute arbitrary SQL commands through the /register.php endpoint. Remote attackers can potentially access, modify, or delete database contents. All deployments of this software version are affected.
💻 Affected Systems
- code-projects Student Information System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access and modification, potentially exposing sensitive student information, grades, and personal data.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage scope.
🎯 Exploit Status
Public exploit available on GitHub. SQL injection via registration endpoint requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries in /register.php or disabling the endpoint if not needed.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting /register.php
Disable Registration Endpoint
linuxRemove or restrict access to /register.php if registration functionality is not required
mv /path/to/register.php /path/to/register.php.disabled
chmod 000 /path/to/register.php
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the application
- Enable detailed logging and monitoring for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test /register.php endpoint with SQL injection payloads like ' OR '1'='1 in form fieldsCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify parameterized queries are implemented or endpoint is inaccessible📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed registration attempts with SQL keywords
Network Indicators:
- HTTP POST requests to /register.php containing SQL keywords (SELECT, UNION, etc.)
SIEM Query:
source="web_logs" AND uri="/register.php" AND (payload="' OR" OR payload="UNION" OR payload="SELECT")