CVE-2025-13325 Overview
CVE-2025-13325 is a SQL injection vulnerability in itsourcecode Student Information System 1.0. The flaw resides in /enrollment_edit1.php, where the en_id parameter is passed to a backend SQL query without proper sanitization. A remote attacker with low-level privileges can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The weaknesses are tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Injection).
Critical Impact
Authenticated remote attackers can inject arbitrary SQL via the en_id parameter, exposing or modifying student enrollment data stored in the application database.
Affected Products
- itsourcecode Student Information System 1.0
- Component: /enrollment_edit1.php
- Vulnerable parameter: en_id
Discovery Timeline
- 2025-11-18 - CVE-2025-13325 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13325
Vulnerability Analysis
The vulnerability exists in the enrollment editing workflow of itsourcecode Student Information System 1.0. The /enrollment_edit1.php script accepts the en_id argument from the request and incorporates it directly into a SQL statement. Because the value is not parameterized or escaped, attackers can break out of the intended query context and append their own SQL syntax. Successful exploitation can lead to unauthorized reading of records, modification of enrollment data, and potentially full disclosure of database contents depending on database privileges.
The issue is reachable over the network and requires only low-level authenticated access to the application. Public disclosure of the exploit details lowers the technical barrier for attackers and increases scanning activity against affected deployments. The current EPSS probability indicates limited near-term mass exploitation, but targeted abuse remains realistic.
Root Cause
The root cause is the absence of input validation and parameterized queries when handling the en_id value. The script concatenates user-supplied input directly into a SQL string. This pattern is the canonical example described in [CWE-89] and falls under the broader injection class [CWE-74].
Attack Vector
An attacker authenticates to the application with any valid low-privilege account and issues a crafted request to /enrollment_edit1.php with a malicious en_id payload. The injection payload alters the executed query, enabling techniques such as UNION-based extraction, boolean-based blind inference, or time-based blind queries against the underlying database.
The vulnerability mechanism is straightforward unsanitized concatenation of the en_id request parameter into a backend SQL statement. No verified proof-of-concept code is provided in the advisory. For technical details, refer to the GitHub CVE Issue Discussion and the VulDB entry #332669.
Detection Methods for CVE-2025-13325
Indicators of Compromise
- Web server access logs containing requests to /enrollment_edit1.php with SQL metacharacters in the en_id parameter such as ', ", --, UNION, SLEEP(, or OR 1=1.
- Database error messages or 500 responses correlated with enrollment_edit1.php requests.
- Unusually long response times for enrollment_edit1.php requests, suggesting time-based blind injection.
Detection Strategies
- Deploy a web application firewall rule set that flags SQL injection signatures specifically on the en_id query parameter.
- Enable database query logging and alert on enrollment-table queries that contain stacked statements or UNION SELECT clauses.
- Correlate authenticated session activity with abnormal volumes of requests to /enrollment_edit1.php from a single source.
Monitoring Recommendations
- Monitor outbound database egress for unexpected bulk reads originating from the web application service account.
- Track failed and successful authentication events that precede injection attempts to identify compromised low-privilege accounts.
- Review historical logs since the publication date of 2025-11-18 for retroactive evidence of exploitation.
How to Mitigate CVE-2025-13325
Immediate Actions Required
- Restrict network access to the Student Information System so that only trusted internal users can reach /enrollment_edit1.php.
- Disable or remove the affected enrollment edit endpoint if it is not in active use.
- Rotate database credentials and audit the enrollment database for unauthorized modifications.
Patch Information
No official vendor patch is referenced in the published advisory data. Operators should monitor the ITSourceCode Resource Hub and the VulDB entry #332669 for any vendor-released fixes. Until a patch is available, apply the workarounds below.
Workarounds
- Modify /enrollment_edit1.php to use parameterized queries or prepared statements via PDO or mysqli bound parameters instead of string concatenation.
- Enforce strict server-side type validation on en_id, accepting only positive integers and rejecting all other input.
- Apply least-privilege principles to the database account used by the application, removing rights to INFORMATION_SCHEMA, FILE, and write operations where unnecessary.
- Deploy a WAF rule that blocks SQL metacharacters submitted to the en_id parameter.
# Example WAF/ModSecurity rule blocking SQL metacharacters in en_id
SecRule ARGS:en_id "@rx (?i)(union|select|sleep\(|--|;|or\s+1=1|')" \
"id:1013325,phase:2,deny,status:403,log,\
msg:'CVE-2025-13325 SQLi attempt against enrollment_edit1.php'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
