CVE-2025-13560
📋 TL;DR
This SQL injection vulnerability in SourceCodester Company Website CMS 1.0 allows attackers to manipulate database queries through the email parameter in the admin password reset function. Attackers can potentially extract, modify, or delete database contents. All installations of this specific CMS version are affected.
💻 Affected Systems
- SourceCodester Company Website CMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including admin credential theft, data exfiltration, and potential remote code execution via database functions.
Likely Case
Extraction of sensitive user data, admin credential harvesting, and potential website defacement or data manipulation.
If Mitigated
Limited impact if database permissions are restricted and web application firewall blocks SQL injection patterns.
🎯 Exploit Status
The exploit is publicly available and requires no authentication. Basic SQL injection techniques can be used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the /admin/reset-password.php file
Edit /admin/reset-password.php to implement prepared statements with parameterized queries
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns targeting the reset-password endpoint
Add WAF rule: Block requests to /admin/reset-password.php containing SQL keywords in email parameter
🧯 If You Can't Patch
- Restrict access to /admin/reset-password.php using IP whitelisting or authentication requirements
- Implement database-level protections: restrict application database user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Test the /admin/reset-password.php endpoint with SQL injection payloads in the email parameter (e.g., email=test' OR '1'='1)Check Version:
Check CMS version in admin panel or readme files; look for 'Company Website CMS 1.0'Verify Fix Applied:
Test with SQL injection payloads after implementing fixes; successful fixes should return error messages or no database manipulation📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple failed password reset attempts with SQL-like patterns in email parameter
- Requests to /admin/reset-password.php with special characters in email
Network Indicators:
- HTTP POST requests to /admin/reset-password.php containing SQL keywords (UNION, SELECT, INSERT, etc.)
- Unusual database query patterns from web server IP
SIEM Query:
source="web_logs" AND uri_path="/admin/reset-password.php" AND (email="*'*" OR email="*--*" OR email="*UNION*" OR email="*SELECT*")