CVE-2025-13346 Overview
CVE-2025-13346 is a SQL injection vulnerability in SourceCodester Train Station Ticketing System 1.0. The flaw resides in the /ajax.php?action=save_station endpoint, where the id and station parameters are passed to backend SQL queries without proper sanitization. Attackers can manipulate these parameters remotely to inject arbitrary SQL statements. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output). A public exploit has been disclosed, increasing exposure for organizations still running this application. The issue is tracked by VulDB as entry #332764 and referenced in a public GitHub issue.
Critical Impact
Authenticated remote attackers can inject SQL commands through the station-save endpoint, potentially exposing or modifying ticketing database records.
Affected Products
- SourceCodester Train Station Ticketing System 1.0
- Vendor: oretnom23
- CPE: cpe:2.3:a:oretnom23:train_station_ticketing_system:1.0:*:*:*:*:*:*:*
Discovery Timeline
- 2025-11-18 - CVE-2025-13346 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13346
Vulnerability Analysis
The vulnerability affects the save_station action handler within ajax.php. When a client submits a request to /ajax.php?action=save_station, the application incorporates the id and station request parameters directly into an SQL query. No parameterized statements or input validation are applied before execution. An attacker with basic authenticated access can supply crafted values that terminate the intended query and append arbitrary SQL. This provides read and write access to the underlying MySQL database used by the ticketing system. The EPSS probability is 0.267% at the 18.271 percentile, indicating limited observed exploitation activity to date. The public disclosure via GitHub and VulDB, however, lowers the barrier for opportunistic exploitation.
Root Cause
The root cause is improper neutralization of special elements passed to a downstream SQL interpreter [CWE-74]. The save_station handler concatenates user-controlled id and station values into an SQL statement without prepared statements, type casting, or escape routines. Any single quote or SQL keyword supplied by the caller alters the query structure.
Attack Vector
The attack is executed over the network against the ajax.php endpoint. Exploitation requires low privileges but no user interaction. A remote authenticated attacker sends a crafted HTTP POST request to /ajax.php?action=save_station with malicious payloads embedded in the id or station fields. Successful injection allows the attacker to enumerate database contents, modify ticketing records, or in some deployments extract credentials stored in adjacent tables.
No verified proof-of-concept code is republished here. Technical details of the injection payload structure are available in the referenced GitHub Issue on CVE and VulDB entry #332764.
Detection Methods for CVE-2025-13346
Indicators of Compromise
- HTTP requests to /ajax.php?action=save_station containing SQL metacharacters such as ', --, UNION, or SLEEP( in the id or station parameters.
- Unexpected MySQL error strings returned in application responses or logged in the web server error log.
- Anomalous database queries originating from the web application user during off-hours or from atypical source IP addresses.
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect POST bodies targeting ajax.php for SQL injection signatures.
- Enable MySQL general query logging temporarily to identify queries containing tautologies such as OR 1=1 or stacked statements.
- Correlate authentication events with subsequent bursts of save_station requests to identify credential abuse.
Monitoring Recommendations
- Alert on repeated 500-level HTTP responses from ajax.php endpoints, which often accompany injection probing.
- Monitor for schema enumeration patterns such as queries referencing information_schema.tables or information_schema.columns.
- Track outbound data volumes from the database host to detect bulk exfiltration following successful injection.
How to Mitigate CVE-2025-13346
Immediate Actions Required
- Restrict network access to the Train Station Ticketing System to trusted management networks until a patch is available.
- Rotate all application and database credentials, particularly if logs show suspicious activity against save_station.
- Enforce strong authentication on the administrative interface and disable unused accounts to limit the pool of low-privilege attackers.
Patch Information
As of the last NVD update on 2026-06-17, no official vendor patch has been published by oretnom23 through SourceCodester. Organizations should monitor the SourceCodester project page and the VulDB advisory for future fixes. In the interim, apply source-level remediation by replacing dynamic SQL concatenation in the save_station handler with parameterized queries using PDO or mysqli prepared statements.
Workarounds
- Modify ajax.php to cast the id parameter to an integer and validate station against an allowlist of expected characters before it reaches the SQL layer.
- Deploy a reverse proxy or WAF rule that blocks requests to /ajax.php?action=save_station containing SQL syntax tokens.
- Restrict the database account used by the application to the minimum privileges required, removing DROP, ALTER, and cross-schema SELECT rights.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
