CVE-2025-13546
📋 TL;DR
This CVE describes a SQL injection vulnerability in the ashraf-kabir travel-agency software's search functionality. Attackers can remotely exploit the /results.php file by manipulating the user_query parameter to execute arbitrary SQL commands. Any deployment of this travel-agency software is affected since versioning information is unavailable.
💻 Affected Systems
- ashraf-kabir travel-agency
📦 What is this software?
Travel Agency by Ashraf Kabir
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, extraction of sensitive information (user credentials, personal data), and potential database corruption.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploit details are publicly available in the referenced GitHub document. Remote exploitation is confirmed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to a maintained alternative or implementing parameterized queries in /results.php.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the user_query parameter to reject SQL injection attempts
Add input sanitization in /results.php before processing user_query
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Isolate the vulnerable system behind a reverse proxy with SQL injection filtering
- Implement network segmentation to limit database access from the vulnerable application
🔍 How to Verify
Check if Vulnerable:
Test the /results.php endpoint with SQL injection payloads in the user_query parameterCheck Version:
Check git commit hash: git log --oneline -1Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple rapid requests to /results.php with suspicious parameters
Network Indicators:
- SQL keywords in HTTP POST/GET parameters to /results.php
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/results.php" AND (user_query CONTAINS "UNION" OR user_query CONTAINS "SELECT" OR user_query CONTAINS "INSERT")