CVE-2025-13254
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A SQL injection vulnerability was identified in projectworlds Advanced Library Management System 1.0 in the file /add_member.php via manipulation of the roll_number argument. The attack can be performed remotely and a publicly available exploit may be used.
Risk Assessment
An unauthenticated attacker can remotely inject SQL queries, risking data leakage, modification, or deletion of library data. A public exploit exists, so the likelihood of exploitation is high.
Recommendation
Update the system to a fixed version as soon as possible or implement input validation and parameterized queries. Until patched, consider restricting access to /add_member.php.
Other vulnerabilities in Advanced Library Management System
See all- CVE-2025-13278Medium
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
- CVE-2025-13256Medium
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been made available to the public.
- CVE-2025-13255Medium
In the Advanced Library Management System 1.0 from projectworlds, a vulnerability was found in the file /book_search.php, where manipulation of the arguments book_pub/book_title results in SQL injection. The attack can be initiated remotely, and the exploit has been publicly released.
- CVE-2025-13253Medium
A SQL injection vulnerability was determined in projectworlds Advanced Library Management System 1.0 in the file /add_librarian.php via manipulation of the Username argument. The attack can be carried out remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /add_member.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS