CVE-2025-13346
📋 TL;DR
This SQL injection vulnerability in SourceCodester Train Station Ticketing System 1.0 allows attackers to manipulate database queries via the /ajax.php?action=save_station endpoint. Remote attackers can potentially read, modify, or delete database contents. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Train Station Ticketing System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, system takeover, or destruction of ticketing data
Likely Case
Unauthorized data access and potential privilege escalation within the application
If Mitigated
Limited impact with proper input validation and database permissions in place
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the source code.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting /ajax.php with save_station action
Input Validation Filter
allAdd server-side validation for id and station parameters to allow only expected data types
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict database user permissions with least privilege principle
🔍 How to Verify
Check if Vulnerable:
Test the /ajax.php?action=save_station endpoint with SQL injection payloads in id or station parametersCheck Version:
Check application version in admin panel or source code filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /ajax.php?action=save_station with suspicious parameters
Network Indicators:
- HTTP POST/GET requests to /ajax.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri_path="/ajax.php" AND (param_name="id" OR param_name="station") AND (param_value CONTAINS "UNION" OR param_value CONTAINS "SELECT" OR param_value CONTAINS "OR 1=1")