CVE-2025-7173
📋 TL;DR
CVE-2025-7173 is a critical SQL injection vulnerability in code-projects Library System 1.0 that allows remote attackers to execute arbitrary SQL commands via the Username parameter in /add-student.php. This affects all deployments of Library System 1.0, potentially compromising database integrity and confidentiality. Attackers can steal, modify, or delete sensitive library data including user credentials and records.
💻 Affected Systems
- code-projects Library System
📦 What is this software?
Library System by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access and modification, credential theft, privilege escalation, and potential data exfiltration from the library database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage to specific tables.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection via Username parameter requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to a supported library management system or implementing custom fixes with parameterized queries and input validation.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to reject malicious SQL characters in Username parameter
Modify /add-student.php to include input sanitization functions
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting /add-student.php
Configure WAF to block requests containing SQL keywords to /add-student.php
🧯 If You Can't Patch
- Block external access to /add-student.php via firewall rules or web server configuration
- Implement database user with minimal permissions (read-only where possible) and enable logging of all database queries
🔍 How to Verify
Check if Vulnerable:
Test /add-student.php endpoint with SQL injection payloads in Username parameter (e.g., ' OR '1'='1)Check Version:
Check application files or documentation for version 1.0 identificationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application, SQL syntax errors in application logs, multiple failed login attempts with SQL characters
Network Indicators:
- HTTP POST requests to /add-student.php containing SQL keywords (UNION, SELECT, INSERT, etc.)
SIEM Query:
source="web_logs" AND uri_path="/add-student.php" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "INSERT")