CVE-2025-13253: Advanced Library Management SQLi Flaw

CVE-2025-13253 Overview

CVE-2025-13253 is a SQL injection vulnerability in Projectworlds Advanced Library Management System 1.0. The flaw resides in the /add_librarian.php script, where the Username parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed and can be triggered remotely over the network. The vulnerability is categorized under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements).

Critical Impact
Remote attackers with low privileges can inject SQL queries through the Username field in /add_librarian.php, potentially exposing database contents and integrity.

Affected Products

Projectworlds Advanced Library Management System 1.0
Component: /add_librarian.php
CPE: cpe:2.3:a:projectworlds:advanced_library_management_system:1.0

Discovery Timeline

2025-11-17 - CVE-2025-13253 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13253

Vulnerability Analysis

The vulnerability exists in the librarian creation workflow of Projectworlds Advanced Library Management System 1.0. The /add_librarian.php endpoint accepts a Username parameter from client requests and embeds the value directly into a SQL statement. Because the application does not use parameterized queries or input sanitization, attackers can break out of the intended string context and append arbitrary SQL clauses.

Exploitation requires network access and a low-privileged authenticated session. Once injected, the SQL payload executes within the application's database context. Depending on database user permissions, attackers may read, modify, or delete records, including credentials and library data.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command ([CWE-89]). User-controlled input from the Username parameter is concatenated into a SQL query string rather than bound as a parameter. This pattern is a classic instance of [CWE-74] improper input neutralization in downstream interpreters.

Attack Vector

An authenticated attacker submits a crafted HTTP request to /add_librarian.php containing a SQL payload in the Username field. The injected statement is parsed by the backend MySQL/MariaDB engine and executed alongside the original query. Public exploit details are available in the GitHub CVE Report and VulDB entry #332588.

No verified code examples are available. Refer to the public reports for payload specifics.

Detection Methods for CVE-2025-13253

Indicators of Compromise

HTTP POST requests to /add_librarian.php containing SQL metacharacters such as ', --, UNION, or OR 1=1 in the Username parameter.
Unexpected database errors or warnings logged by the PHP application when handling librarian creation requests.
New or modified librarian accounts with anomalous usernames containing SQL syntax fragments.

Detection Strategies

Inspect web server access logs for requests to /add_librarian.php with encoded or raw SQL syntax in form parameters.
Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the Username field.
Correlate authentication events with administrative actions to identify unauthorized librarian account creation.

Monitoring Recommendations

Enable verbose MySQL query logging on the database backing the library system and review for malformed INSERT INTO librarian statements.
Alert on HTTP 500 responses from /add_librarian.php that may indicate failed injection attempts.
Monitor outbound database traffic for anomalous query volume from the application server.

How to Mitigate CVE-2025-13253

Immediate Actions Required

Restrict access to the /add_librarian.php endpoint to trusted administrative networks or via VPN until a patch is applied.
Audit the librarian table for unauthorized accounts and reset credentials for any suspicious entries.
Place a WAF in front of the application with rules blocking SQL injection patterns on POST parameters.

Patch Information

No vendor advisory or patch has been published by Projectworlds at the time of writing. Organizations running Projectworlds Advanced Library Management System 1.0 should consider replacing the affected component or applying source-level fixes that convert the vulnerable query to a prepared statement using PDO or mysqli parameter binding.

Workarounds

Modify /add_librarian.php to use prepared statements with bound parameters instead of string concatenation.
Apply server-side input validation that rejects non-alphanumeric characters in the Username field.
Run the application database account with least privilege so injection cannot escalate to schema-level changes.

bash

# Example: convert vulnerable query to a prepared statement (PHP / mysqli)
$stmt = $conn->prepare("INSERT INTO librarian (Username, Password) VALUES (?, ?)");
$stmt->bind_param("ss", $username, $password_hash);
$stmt->execute();