CVE-2025-13580
📋 TL;DR
CVE-2025-13580 is a SQL injection vulnerability in code-projects Library System 1.0 affecting the /mail.php file. Attackers can remotely exploit this to execute arbitrary SQL commands on the database. All deployments of Library System 1.0 with the vulnerable /mail.php file are affected.
💻 Affected Systems
- code-projects Library System
📦 What is this software?
Library System by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub and vuldb.com, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the ID parameter in /mail.php
Edit /mail.php and add: $id = intval($_GET['ID']); before any SQL queries
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL injection patterns in URL parameters
🧯 If You Can't Patch
- Disable or remove /mail.php file if not required
- Implement network segmentation to restrict access to vulnerable system
🔍 How to Verify
Check if Vulnerable:
Check if /mail.php exists and accepts ID parameter without proper sanitization. Test with SQL injection payloads like: /mail.php?ID=1' OR '1'='1Check Version:
Check software version in admin panel or configuration files. Default is 1.0.Verify Fix Applied:
Test with SQL injection payloads after applying workarounds to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /mail.php with suspicious parameters
- Database query patterns with concatenated strings
Network Indicators:
- HTTP requests to /mail.php containing SQL keywords (UNION, SELECT, etc.)
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/mail.php" AND (param="ID" AND value MATCHES "[';]|UNION|SELECT")