CVE-2025-13396
📋 TL;DR
CVE-2025-13396 is a SQL injection vulnerability in code-projects Courier Management System 1.0 that allows attackers to manipulate database queries through the OfficeName parameter in /add-office.php. This can lead to unauthorized data access, modification, or deletion. Organizations using this specific software version are affected.
💻 Affected Systems
- code-projects Courier Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive courier management data, customer information exposure, or database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb. SQL injection attacks are well-understood and easily automated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of OfficeName parameter
Modify /add-office.php to validate and sanitize OfficeName input
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Isolate the Courier Management System behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test /add-office.php endpoint with SQL injection payloads in OfficeName parameterCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web server logs
Network Indicators:
- SQL injection patterns in HTTP requests to /add-office.php
SIEM Query:
source="web_server" AND uri="/add-office.php" AND (OfficeName CONTAINS "' OR" OR OfficeName CONTAINS "--" OR OfficeName CONTAINS ";")