CVE-2025-13255
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In the Advanced Library Management System 1.0 from projectworlds, a vulnerability was found in the file /book_search.php, where manipulation of the arguments book_pub/book_title results in SQL injection. The attack can be initiated remotely, and the exploit has been publicly released.
Risk Assessment
SQL injection can allow an attacker to gain unauthorized access to the database, potentially leading to disclosure, modification, or deletion of library data.
Recommendation
It is recommended to immediately apply patches or restrict access to /book_search.php and use parameterized queries.
Other vulnerabilities in Advanced Library Management System
See all- CVE-2025-13278Medium
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
- CVE-2025-13256Medium
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been made available to the public.
- CVE-2025-13254Medium
A SQL injection vulnerability was identified in projectworlds Advanced Library Management System 1.0 in the file /add_member.php via manipulation of the roll_number argument. The attack can be performed remotely and a publicly available exploit may be used.
- CVE-2025-13253Medium
A SQL injection vulnerability was determined in projectworlds Advanced Library Management System 1.0 in the file /add_librarian.php via manipulation of the Username argument. The attack can be carried out remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. This issue affects some unknown processing of the file /book_search.php. Performing a manipulation of the argument book_pub/book_title results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS