CVE-2025-13253
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A SQL injection vulnerability was determined in projectworlds Advanced Library Management System 1.0 in the file /add_librarian.php via manipulation of the Username argument. The attack can be carried out remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can inject SQL queries, potentially leading to unauthorized data access or modification. Public disclosure of the exploit increases the risk of exploitation.
Recommendation
Update the system to a patched version or implement input validation and parameterized queries. Consider restricting access to /add_librarian.php until patched.
Other vulnerabilities in Advanced Library Management System
See all- CVE-2025-13278Medium
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
- CVE-2025-13256Medium
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been made available to the public.
- CVE-2025-13255Medium
In the Advanced Library Management System 1.0 from projectworlds, a vulnerability was found in the file /book_search.php, where manipulation of the arguments book_pub/book_title results in SQL injection. The attack can be initiated remotely, and the exploit has been publicly released.
- CVE-2025-13254Medium
A SQL injection vulnerability was identified in projectworlds Advanced Library Management System 1.0 in the file /add_member.php via manipulation of the roll_number argument. The attack can be performed remotely and a publicly available exploit may be used.
Original NVD description (English source)
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /add_librarian.php. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS