CVE-2025-13287
📋 TL;DR
CVE-2025-13287 is a SQL injection vulnerability in itsourcecode Online Voting System 1.0 that allows remote attackers to execute arbitrary SQL commands via the id/category parameter in /index.php?page=categories. This affects all deployments of this specific voting system software. Attackers could potentially read, modify, or delete database content.
💻 Affected Systems
- itsourcecode Online Voting System
📦 What is this software?
Online Voting System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including voter data theft, vote manipulation, administrative credential theft, and potential system takeover.
Likely Case
Data exfiltration of voter information, vote records, and system configuration data leading to privacy violations and election integrity compromise.
If Mitigated
Limited information disclosure if database permissions are properly restricted and input validation is implemented.
🎯 Exploit Status
Public exploit available on GitHub. SQL injection is straightforward to exploit with common tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative voting systems or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Input Validation Filter
allImplement server-side validation to reject malicious input patterns in id/category parameters
🧯 If You Can't Patch
- Isolate the voting system behind strict network segmentation and limit external access
- Implement database-level controls: use least privilege accounts, enable audit logging, and restrict database permissions
🔍 How to Verify
Check if Vulnerable:
Test /index.php?page=categories with SQL injection payloads in id or category parameters using tools like sqlmap or manual testing with ' OR '1'='1Check Version:
Check application version in admin panel or source code commentsVerify Fix Applied:
Verify that parameterized queries are implemented and SQL injection payloads no longer execute📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple rapid requests to /index.php?page=categories with varying parameters
- Database queries containing SQL keywords from web requests
Network Indicators:
- HTTP requests with SQL injection patterns in parameters
- Unusual database connection patterns from web server
SIEM Query:
web.url:*index.php*page=categories* AND (web.param:*OR* OR web.param:*UNION* OR web.param:*SELECT* OR web.param:*--*)