CVE-2025-13302
📋 TL;DR
CVE-2025-13302 is an SQL injection vulnerability in code-projects Courier Management System 1.0 that allows attackers to manipulate database queries through the ManagerName parameter in /add-new-officer.php. This can lead to unauthorized data access, modification, or deletion. Organizations using this specific software version are affected.
💻 Affected Systems
- code-projects Courier Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover through privilege escalation.
Likely Case
Unauthorized access to sensitive courier management data, customer information, or business records.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage scope.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb.com, making this easily exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates 2. If no patch available, implement workarounds 3. Consider replacing with alternative software
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries and input validation to /add-new-officer.php
Modify PHP code to use prepared statements: $stmt = $conn->prepare('INSERT INTO officers (ManagerName) VALUES (?)'); $stmt->bind_param('s', $ManagerName);
Access Restriction
allBlock access to vulnerable endpoint or restrict to authorized users only
Add .htaccess rules: Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
Add authentication check at top of add-new-officer.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Isolate the system in a segmented network with strict access controls
🔍 How to Verify
Check if Vulnerable:
Test /add-new-officer.php endpoint with SQL injection payloads in ManagerName parameterCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Attempt SQL injection after implementing fixes and verify no database errors or unexpected behavior📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
- Multiple failed login attempts or parameter manipulation
Network Indicators:
- HTTP requests to /add-new-officer.php with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_server.log" AND ("add-new-officer.php" AND ("SELECT" OR "UNION" OR "--" OR "' OR '1'='1"))