CVE-2025-13255: Advanced Library Management SQL Injection

CVE-2025-13255 Overview

CVE-2025-13255 is a SQL injection vulnerability in Projectworlds Advanced Library Management System 1.0. The flaw resides in the /book_search.php script, where the book_pub and book_title parameters are passed into database queries without proper sanitization. Remote attackers with low privileges can manipulate these parameters to inject arbitrary SQL statements. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed deployments. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can manipulate book_pub or book_title parameters in /book_search.php to execute SQL injection against the underlying database.

Affected Products

Projectworlds Advanced Library Management System 1.0
CPE: cpe:2.3:a:projectworlds:advanced_library_management_system:1.0
Component: book_search.php

Discovery Timeline

2025-11-17 - CVE-2025-13255 published to the National Vulnerability Database
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13255

Vulnerability Analysis

The vulnerability exists in the search functionality of Projectworlds Advanced Library Management System 1.0. The /book_search.php endpoint accepts user-supplied input through the book_pub and book_title HTTP parameters. These values are concatenated into a SQL query without parameterized binding or input filtering. As a result, attacker-controlled characters such as single quotes, UNION operators, and SQL comments alter the structure of the executed statement. Public disclosure of the exploit methodology lowers the barrier to entry for attackers scanning for vulnerable instances.

Root Cause

The root cause is improper neutralization of special elements in SQL statements, classified under [CWE-89]. The application directly interpolates HTTP request parameters into SQL queries without using prepared statements or escaping routines. PHP applications relying on legacy mysql_query or unsanitized mysqli calls are typical hosts for this pattern. The absence of an input validation layer compounds the issue across multiple parameters in the same script.

Attack Vector

The attack vector is network-based and requires low privileges, consistent with an authenticated user account on the library application. An attacker sends a crafted HTTP request to /book_search.php with malicious payloads embedded in book_pub or book_title. Successful exploitation can lead to disclosure of book records, user credentials stored in the database, and tampering with library data. Boolean-based, error-based, and UNION-based SQL injection techniques are all applicable given the query context.

For technical proof-of-concept details, see the GitHub CVE-003 Report, the GitHub CVE-004 Report, and the VulDB entry #332590.

Detection Methods for CVE-2025-13255

Indicators of Compromise

HTTP requests to /book_search.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the book_pub or book_title parameters.
Web server access logs showing repeated requests to book_search.php with abnormally long query strings or encoded payloads (%27, %20OR%201=1).
Database error messages surfaced in HTTP responses, indicating error-based injection probing.
Unexpected outbound database queries returning columns or tables unrelated to the book search workflow.

Detection Strategies

Deploy a web application firewall (WAF) rule set tuned for SQL injection signatures targeting the book_search.php endpoint.
Enable database query logging and alert on statements containing UNION SELECT, INFORMATION_SCHEMA, or stacked queries originating from the library application.
Correlate authentication events with anomalous query patterns to identify low-privileged accounts probing the search endpoint.

Monitoring Recommendations

Forward web server and database logs to a centralized SIEM for correlation across the application tier.
Alert on HTTP 500 responses from /book_search.php, which often accompany injection attempts that trigger SQL syntax errors.
Track query execution times for the search workflow to identify time-based blind SQL injection attempts using SLEEP() or BENCHMARK().

How to Mitigate CVE-2025-13255

Immediate Actions Required

Restrict network access to the Projectworlds Advanced Library Management System until a vendor patch is available.
Audit application accounts and remove unnecessary low-privileged users that could be leveraged for authenticated exploitation.
Place the application behind a WAF configured to block SQL injection payloads targeting book_pub and book_title parameters.
Review database logs for evidence of prior exploitation attempts referencing /book_search.php.

Patch Information

At the time of publication, no vendor advisory or official patch has been listed in the NVD references for Projectworlds Advanced Library Management System 1.0. Administrators should monitor the VulDB entry #332590 and the vendor's distribution channels for fix availability. In the interim, manual code remediation by replacing direct query concatenation in book_search.php with parameterized queries using mysqli_prepare or PDO prepared statements is recommended.

Workarounds

Modify book_search.php to use prepared statements with bound parameters for the book_pub and book_title inputs.
Apply server-side input validation that rejects SQL metacharacters where they are not semantically required.
Enforce least-privilege database accounts so the web application cannot read system tables or write outside its required scope.
Disable verbose database error reporting in production to limit information available to attackers.

bash

# Example: restrict access to book_search.php via Apache configuration
<Location "/book_search.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>

# Example: minimal MySQL grant for the application user
REVOKE ALL PRIVILEGES ON *.* FROM 'library_app'@'%';
GRANT SELECT, INSERT, UPDATE ON library_db.* TO 'library_app'@'%';
FLUSH PRIVILEGES;