CVE-2025-13581: Student Information System SQLi Flaw

CVE-2025-13581 Overview

CVE-2025-13581 is a SQL injection vulnerability in itsourcecode Student Information System 1.0. The flaw resides in the /schedule_edit1.php file, where the schedule_id parameter is passed directly to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements.

The vulnerability is remotely exploitable and requires low-privilege authentication. A public exploit has been disclosed, increasing the risk of opportunistic attacks against exposed instances. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Injection).

Critical Impact
Authenticated remote attackers can extract, modify, or delete student records by injecting SQL through the schedule_id parameter in /schedule_edit1.php.

Affected Products

itsourcecode Student Information System 1.0
Component: /schedule_edit1.php
Vulnerable parameter: schedule_id

Discovery Timeline

2025-11-24 - CVE-2025-13581 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13581

Vulnerability Analysis

The vulnerability exists in the schedule_edit1.php endpoint of the Student Information System. The application accepts a schedule_id value from HTTP request parameters and concatenates it directly into a SQL query string. No prepared statements, parameterized queries, or input sanitization routines validate the supplied value before query execution.

This allows an attacker to break out of the intended query context and append arbitrary SQL clauses. Depending on the underlying database schema, attackers can enumerate tables, extract user credentials, modify schedule data, or escalate access within the application. The flaw is exploitable over the network with only low-privilege authentication.

A publicly available exploit reference is published on GitHub through the ltranquility CVE issue tracker, and a vulnerability disclosure record is available at VulDB entry #333345.

Root Cause

The root cause is improper neutralization of special characters in the schedule_id parameter before it is used in a SQL statement. The PHP code relies on direct string concatenation rather than mysqli_prepare() or PDO parameter binding. This pattern is a textbook instance of CWE-89.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /schedule_edit1.php with a malicious schedule_id value containing SQL metacharacters. The injected payload alters the original query logic, enabling UNION-based, boolean-based, or time-based blind SQL injection techniques. No user interaction beyond a valid low-privilege session is required.

The vulnerability stems from passing the schedule_id GET or POST parameter directly into a query such as SELECT * FROM schedules WHERE id = $schedule_id. Without parameter binding, an input like 1 OR 1=1-- modifies the WHERE clause and returns unintended rows. See the public proof-of-concept discussion for additional technical context.

Detection Methods for CVE-2025-13581

Indicators of Compromise

HTTP requests to /schedule_edit1.php containing SQL metacharacters such as single quotes, UNION SELECT, --, OR 1=1, or SLEEP( in the schedule_id parameter.
Unusual database errors logged by the PHP application referencing the schedules table or syntax exceptions.
Unexpected outbound traffic or data exfiltration patterns from the web server hosting the Student Information System.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query and body parameters submitted to /schedule_edit1.php for SQL injection signatures.
Enable verbose database query logging and alert on malformed queries originating from the application's database account.
Correlate web access logs with database audit logs to identify suspicious request-to-query patterns targeting the schedule endpoint.

Monitoring Recommendations

Monitor authentication logs for low-privilege accounts issuing high volumes of requests to /schedule_edit1.php.
Track HTTP 500 responses from the affected endpoint, which often indicate SQL injection probing.
Alert on database connections executing queries that return abnormally large result sets from the schedules or related student tables.

How to Mitigate CVE-2025-13581

Immediate Actions Required

Restrict network access to the Student Information System using firewall rules or VPN-only access until a patch is applied.
Audit existing application accounts and revoke unnecessary low-privilege access that could be abused for exploitation.
Review recent web server and database logs for indicators of prior exploitation attempts.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2025-13581. Consult the ItSourceCode project page for vendor updates. Organizations should plan to replace the affected code path with parameterized queries or migrate away from the unmaintained application.

Workarounds

Modify /schedule_edit1.php to use mysqli_prepare() with bound parameters or PDO prepared statements for the schedule_id value.
Implement server-side input validation that enforces schedule_id as an integer before passing it to any database function.
Deploy a web application firewall rule blocking SQL injection payloads targeting the schedule_id parameter on /schedule_edit1.php.
Run the database account used by the application with least-privilege permissions to limit the blast radius of successful injection.

bash

# Example WAF rule (ModSecurity) blocking SQLi on schedule_id
SecRule REQUEST_URI "@beginsWith /schedule_edit1.php" \
    "chain,deny,status:403,id:1013581,msg:'CVE-2025-13581 SQLi attempt'"
    SecRule ARGS:schedule_id "@detectSQLi" "t:none,t:urlDecode"