CVE-2025-13395: codehub666 94list SQL Injection Flaw

CVE-2025-13395 Overview

CVE-2025-13395 is a SQL injection vulnerability in the codehub666 94list project, affecting code up to commit 5831c8240e99a72b7d3508c79ef46ae4b96befe8. The flaw resides in the Login function within /function.php, where attacker-controlled input is concatenated into a SQL query without proper sanitization. Remote attackers can exploit this issue over the network without authentication. A public exploit has been released, increasing the likelihood of opportunistic abuse. Because the project does not use formal versioning, no specific affected or fixed release identifiers are available.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the Login function in /function.php, potentially exposing or manipulating backend database contents.

Affected Products

codehub666 94list (project on GitHub)
Code up to commit 5831c8240e99a72b7d3508c79ef46ae4b96befe8
No versioned releases — all deployments tracking the affected commit range are impacted

Discovery Timeline

2025-11-19 - CVE-2025-13395 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13395

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The Login function in /function.php constructs a SQL query using input received from the login request without applying parameterization or input sanitization. An attacker submitting crafted credentials can break out of the intended query context and append arbitrary SQL clauses.

Because the entry point is the authentication routine, exploitation requires no prior credentials or user interaction. Attackers can reach the vulnerable function directly over the network by sending HTTP requests to the application's login endpoint. The EPSS score is 0.03%, but the public availability of exploit details elevates the practical risk for exposed instances.

Successful exploitation can yield unauthorized read or write access to the underlying database, including session tokens, credentials, and stored user data. In some configurations, SQL injection can also be leveraged to read or write files on the database server or to escalate to authentication bypass.

Root Cause

The root cause is direct concatenation of untrusted user-supplied login parameters into a SQL statement inside the Login function of /function.php. The code path lacks prepared statements, parameter binding, and input validation, allowing SQL metacharacters to alter query structure.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker crafts a malicious HTTP request to the login endpoint with SQL payloads embedded in the username or password fields. Public proof-of-concept details have been disclosed through the project's GitHub issue tracker and VulDB, lowering the barrier for exploitation.

The vulnerability mechanism is documented in the GitHub Issue #63 and the VulDB entry #332923. No verified exploit code is reproduced here; refer to the upstream advisory for technical specifics.

Detection Methods for CVE-2025-13395

Indicators of Compromise

HTTP POST requests to the /function.php login endpoint containing SQL metacharacters such as ', --, UNION, SELECT, or OR 1=1
Unexpected database errors logged by the application around login attempts
Anomalous successful logins from new IP addresses immediately following malformed login requests
Outbound database queries with abnormal structure or duration during authentication flows

Detection Strategies

Inspect web server access logs for login requests containing URL-encoded SQL syntax targeting /function.php
Deploy a web application firewall (WAF) rule set tuned to flag SQL injection patterns on the login endpoint
Enable database query logging and alert on syntactically anomalous statements originating from the Login code path
Correlate failed authentication bursts with subsequent privileged actions to surface injection-based bypass attempts

Monitoring Recommendations

Monitor authentication endpoints for high-entropy or oversized credential fields indicative of injection payloads
Alert on database errors returned to clients during login, which can signal probing activity
Track session creation events that lack a preceding valid credential validation step

How to Mitigate CVE-2025-13395

Immediate Actions Required

Restrict public exposure of the 94list application until a fix is applied; place it behind authentication, VPN, or IP allowlisting
Deploy WAF signatures that block SQL injection patterns targeting the /function.php login endpoint
Audit database accounts used by the application and reduce privileges to the minimum required for runtime operation
Review authentication and database logs for prior exploitation attempts

Patch Information

No official patched release is identified in the CVE record. The project does not use formal versioning, so administrators should track the upstream repository for remediation commits and review the GitHub Issue #63 discussion for fix guidance. Until a verified fix is published, replace vulnerable query construction in the Login function with parameterized queries or prepared statements.

Workarounds

Modify /function.php to use parameterized queries or an ORM that enforces parameter binding for all Login database operations
Apply server-side input validation on username and password fields to reject SQL metacharacters before query construction
Enforce least-privilege database credentials so that an injected query cannot read or modify data outside the application schema
Disable verbose database error messages in production to limit information leakage to attackers probing the endpoint

bash

# Example: restrict access to the login endpoint via nginx until patched
location = /function.php {
    allow 10.0.0.0/8;        # internal management network
    deny all;
    fastcgi_pass php_backend;
}